Google Cloud Document AI vulnerability allows unauthorized data access via service agent
Vectra AI disclosed a vulnerability in Google Cloud Document AI that could allow unauthorized access to cloud storage buckets through overly broad service agent permissions, enabling data theft and potential malware injection. The vulnerability was reported in April 2024 but reportedly remained unresolved as of September 2024.
What happened
Google Cloud Document AI, a machine learning service for extracting structured data from documents, contains a vulnerability that allows unauthorized access to cloud storage buckets within the same project. The service uses the Document AI Core Service Agent with broad permissions to access any Cloud Storage bucket during batch processing jobs, regardless of the caller's original access restrictions.
A malicious actor with sufficient permissions to create or modify processors could exploit this vulnerability to read and transfer data from storage buckets they would not normally have access to, bypassing access control policies through transitive access abuse. Vectra AI reported the vulnerability to Google through the Vulnerability Reward Program on April 4, 2024.
Reported impact
The vulnerability poses serious data exfiltration risks, potentially allowing theft of sensitive data from people's cloud storage accounts. Malicious actors could also potentially smuggle malware into systems through the service.
Index analysis
The vulnerability stems from the Document AI Core Service Agent possessing overly broad permissions not limited to resources needed for the specific task. The permission model allows access to any Cloud Storage bucket within the project, creating a significant security gap that enables transitive access abuse.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.