Path Traversal in Kestra LocalStorage via Backslash Bypass with POC

Vulnerability Overview Vulnerability Name: Path traversal in allows any authenticated user to read arbitrary server files via the file-download API ( bypasses the guard) Vulnerability Description: This vulnerability allows any authenticated user to read arbitrary server files by exploiting the file-download API. Attackers can bypass the protection against forward slashes ( ) by using backslashes ( ), thereby accessing arbitrary files. The root cause is an incorrect validation order (validate-before-canonicalize), where validation is performed before path canonicalization. Impact Scope Affected Versions: - Maven package: /tmp/kestra_poc.sh /dev/null 2>&1 docker rm -f kestra_poc >/dev/null 2>&1 docker run -d --name kestra_poc -p 18080:8080 \ -e KESTRA_CONFIG_STORAGE_TYPE=local \ -e KESTRA_CONFIG_DATABASE_TYPE=h2 \ -e KESTRA_CONFIG_REDIS_TYPE=none \ -e KESTRA_CONFIG_KAFKA_TYPE=none \ -e KESTRA_CONFIG_ZOOKEEPER_TYPE=none \ -e KESTRA_CONFIG_KAFKA_BOOTSTRAP_SERVERS=none \ -e KESTRA_CONFIG_KAFKA_SCHEMA_REGISTRY_URL=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_GROUP=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_AUTO_OFFSET_RESET=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_ENABLE_AUTO_COMMIT=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_SESSION_TIMEOUT_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_HEARTBEAT_INTERVAL_MS=none \ -e KESTRA_CONFIG_KAFKA_CONSUMER_MAX_POLL_RECORDS=

Goal Reached Thanks to every supporter — we hit 100%!

Path Traversal in Kestra LocalStorage via Backslash Bypass with POC

More from this source