CVE-2024-12236: Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration
A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC.
No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12236?
CVE-2024-12236 has been rated as a high-severity vulnerability due to potential data exfiltration risks.
How do I fix CVE-2024-12236?
To mitigate CVE-2024-12236, ensure that your Vertex Gemini API configuration adheres to the VPC-SC security parameters and restrict file URI inputs.
Who is affected by CVE-2024-12236?
CVE-2024-12236 affects customers using Google Cloud Platform's Vertex Gemini API with VPC-SC enabled.
What is the impact of CVE-2024-12236?
The impact of CVE-2024-12236 includes the possibility of sensitive data being exfiltrated outside of the intended VPC-SC security perimeter.
How can I prevent data exfiltration related to CVE-2024-12236?
Preventing data exfiltration related to CVE-2024-12236 involves strict validation of file URIs and compliance with VPC-SC policies.