XSS in Google Cloud Theia notebooks

Summary

This vulnerability chain exploits a Cross-Site Scripting (XSS) flaw (CVE-2021-41038) within the Theia IDE used in Google Vertex AI Workbench. An attacker could inject malicious JavaScript code into the Theia IDE. This code could then be used to steal the OAuth token associated with the project's default Compute Engine service account, because when a user-managed Vertex AI Workbench instance is created, it utilizes the project's default Compute Engine service account. At the time, this default service account had the Editor Role assigned by default.

Affected Services

Cloud Vertex AI Workbench

Remediation

None, as the Theia IDE is no longer offered as a Vertex AI experimental image.

Tracked CVEs

CVE-2021-41038

References

Contributed by https://github.com/KatTraxler