Description
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
uber kraken
Default version status: unaffected
0 to ≤ 0.1.29affected
pkg:golang/github.com/uber/krakenReferences
- https://github.com/uber/kraken/issues/645 ↗
- https://github.com/uber/kraken ↗
- https://github.com/uber/kraken/blob/v0.1.27/lib/backend/namepath/pather.go#L78-L84 ↗
- https://github.com/uber/kraken/blob/v0.1.27/lib/backend/testfs/server.go#L165-L173 ↗
- https://github.com/uber/kraken/blob/v0.1.27/build-index/tagserver/server.go#L128-L129 ↗
- https://www.vulncheck.com/advisories/uber-kraken-through-0.1.29-path-traversal-via-tag-parameter ↗