Google Cloud Text-to-Speech - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/google-cloud-text-to-speech/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 02 Sep 2026 20:46:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInformation Disclosure in ReadToMyShoe via Google Cloud API Key Leakagehttps://feed.craftedsignal.io/briefs/2026-09-cve-2023-27587/Wed, 02 Sep 2026 20:46:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2023-27587/ReadToMyShoe version 0.2.0 is vulnerable to information disclosure (CVE-2023-27587) where sensitive Google Cloud API keys are exposed within error messages during failed Text-to-Speech (TTS) requests.ReadToMyShoe (RTMS) version 0.2.0, a web application written in Rust using the Yew and Axum frameworks, contains an information disclosure vulnerability (CVE-2023-27587) related to how it handles external service requests. When a user submits content for conversion, the application utilizes the Google Cloud Text-to-Speech (TTS) service. If the TTS request fails, the application returns an error message that explicitly includes the full request URL. Because this URL contains an embedded Google Cloud API key, the error message inadvertently provides the key to any user or entity capable of triggering the failure. An attacker can exploit this by forcing specific conditions that cause TTS requests to fail, allowing for the extraction of valid credentials. Once obtained, these keys can be used to perform unauthorized operations within the victim's Google Cloud environment.

Attack Chain

  1. An attacker identifies a target instance of ReadToMyShoe running version 0.2.0.
  2. The attacker crafts a request to the application's /api/add-article-by-text endpoint.
  3. The attacker provides specific input parameters designed to trigger a failure in the application's backend call to the Google Cloud TTS API.
  4. The backend process initiates an outgoing HTTPS request to the Google Cloud TTS service, which includes the API key in the URL.
  5. The Google Cloud service returns a failure response to the application.
  6. The application catches the failure and generates an error response for the client.
  7. The application returns the full request URL, containing the plaintext Google Cloud API key, within the error response body.
  8. The attacker parses the error response to capture the leaked API key for subsequent unauthorized access to cloud resources.

Impact

Successful exploitation results in the unauthorized disclosure of Google Cloud API keys. This credential leakage allows attackers to authenticate as the owner of the key within Google Cloud, leading to potential unauthorized use of services, resource consumption, or data access depending on the permissions associated with the compromised key. The vulnerability carries a CVSS score of 7.4 (High).

Recommendation

Prioritize the identification and remediation of any ReadToMyShoe deployments version 0.2.0 or earlier.

  • Upgrade ReadToMyShoe to a version patched after 2023-03-13, as the maintainers addressed this vulnerability by preventing the inclusion of sensitive request details in application error responses.
  • Audit logs for suspicious POST requests to the /api/add-article-by-text endpoint followed by 4xx or 5xx error responses.
  • If a leak is suspected, immediately revoke the existing Google Cloud API key associated with the ReadToMyShoe instance and generate a new key with restricted scopes.
]]>highadvisoryinformation-disclosurecloud-securityapi-security