Google Vertex AI Flaw Lets Low-Privilege Users Escalate to Service Agent Roles

Cybersecurity: Vertex AI Vulnerabilities

Security researchers have identified critical privilege escalation vulnerabilities within Google's Vertex AI platform. These vulnerabilities enable attackers with minimal permissions to exploit high-privileged Service Agent accounts.

The issues are present in the Vertex AI Agent Engine and Ray on Vertex AI. They arise from default configurations that allow low-privileged users to access powerful managed identities with project-wide permissions.

The rapid deployment of Generative AI infrastructure by enterprises, with 98% currently experimenting or implementing platforms like Google Cloud Vertex AI, highlights the significance of these identity risks to cloud environments.

Service Agents, managed by Google Cloud, are special service accounts that perform internal operations on behalf of users and often receive broad permissions automatically.

Vertex AI Agent Engine Tool Injection Vulnerability

The first identified vulnerability targets the Vertex AI Agent Engine, which allows developers to deploy AI agents on GCP infrastructure using frameworks such as Google's ADK.

Primary Target: Reasoning Engine Service Agent (Vertex AI Agent Engine) vs. Custom Code Service Agent (Ray on Vertex AI) Vulnerability Type: Malicious Tool Call (RCE) vs. Insecure Default Access (Viewer to Root) Initial Permission: aiplatform.reasoningEngines.update vs. aiplatform.persistentResources.get/list Impact: LLM memories, chats, GCS access vs. Ray cluster root; BigQuery/GCS R/W

Researchers discovered that attackers with aiplatform.reasoningEngines.update permission can inject malicious Python code into tool calls within reasoning engines. This attack updates an existing reasoning engine with a tool containing malicious code. When triggered, the code runs on the reasoning engine's compute instance, potentially extracting credentials for the "Reasoning Engine Service Agent" via the instance metadata service.

By default, this service agent has extensive permissions, including access to Vertex AI memories, chat sessions, storage buckets, and logging capabilities.

The second vulnerability targets Ray on Vertex AI clusters, where the "Custom Code Service Agent" automatically attaches to cluster head nodes. Researchers found that users with only aiplatform.persistentResources.list and aiplatform.persistentResources.get permissions, included in the standard "Vertex AI Viewer" role, can gain root access to head nodes via the GCP Console.

Despite having read-only viewer permissions, attackers can obtain a root shell through the "Head node interactive shell" link in the console. They can then query the metadata service to retrieve the Custom Code Service Agent access token. While the token has a limited IAM operation scope, it grants extensive control over storage buckets, BigQuery resources, Pub/Sub, and read-only access across the cloud platform.

Organizations using Vertex AI should consider revoking unnecessary Service Agent permissions using custom roles, disabling head node shells, validating tool code before updates, and monitoring metadata service accesses through the Security Command Center.

Based on reporting by GBHackers.