CVE-2024-12236: Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration
Description
A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC.
No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
Classification
CVE ID: CVE-2024-12236
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.8
Affected Products
Vendor: Google Cloud Platform
Product: Vertex Gemini API
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.44% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)