New attack technique: Inject a Malicious Startup Script into a Vertex AI Workbench Instance (gcp.execution.modify-vertex-notebook-startup)#845
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c40324eb37
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if scriptURL == "" { | ||
| delete(metadata, "post-startup-script") | ||
| } else { | ||
| metadata["post-startup-script"] = scriptURL |
There was a problem hiding this comment.
When detonating against the warmed Workbench instance, this only sets post-startup-script and leaves post-startup-script-behavior at its default. Google's Workbench metadata docs define the default run_once as running after instance creation or upgrade, while run_every_start/download_and_run_every_start are the values that run after starts; because warm-up has already created the instance and detonate doesn't upgrade it, the injected URI won't execute on the advertised “next start” unless this metadata key is set too.
Useful? React with 👍 / 👎.
… AI Workbench Instance (gcp.execution.modify-vertex-notebook-startup) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Address PR feedback: warm-up fails with a 403 when notebooks.googleapis.com is not enabled. Add a note in the technique description so users know to enable the API beforehand.
christophetd
force-pushed
the
simon.marechal/gcp-execution-modify-vertex-notebook-startup
branch
from
b6beed2 to
b768703
Compare
This comment has been minimized.
This comment has been minimized.
christophetd
deleted the
simon.marechal/gcp-execution-modify-vertex-notebook-startup
branch
2 participants
What does this PR do?
New attack technique:
gcp.execution.modify-vertex-notebook-startupRecreated PR — original #798 was inadvertently merged into the #797 branch (the stacked base) instead of
main. This PR re-targets the same change againstmain.Motivation
GCP parity with existing AWS attack techniques.
Test results
stratus detonate gcp.execution.modify-vertex-notebook-startupgoogle.cloud.notebooks.v2.NotebookService.UpdateInstanceappears in GCP Admin Activity audit logs (no audit log observed — may require non-default audit config for Notebooks DATA_WRITE events)Checklist