Vulnerability · Published Dec 10, 2024 · Assigned by Google
CVE-2024-12236Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration
Medium 6.8
In plain English
A medium-severity security flaw in Vertex Gemini API from Google Cloud Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Official description
A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud Platform | Vertex Gemini API | 0 |
Weakness: CWE-755 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N