Google Cloud Document AI flaw (still) allows data theft despite bounty payout
ID: 1e60a9cb-d412-5477-a2bd-26c0d76bd1e5
STIX ID: report--1e60a9cb-d412-5477-a2bd-26c0d76bd1e5
Feed Name: The Register (Security)
Threat Score
Vectra AI researcher Kat Traxler disclosed that Google Cloud's Document AI batch-processing service agent has overly broad Cloud Storage permissions, allowing an attacker with access to a victim project to exfiltrate documents between buckets; she published a proof-of-concept, documented the disclosure timeline and dispute over Google's remediation and bug-bounty handling, and received a $3,133.70 award despite asserting the issue remains uncorrected.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.