Skip to content
Log inStart free trial

GHSA-c866-8gpw-p3mv CVE-2024-1329 GO-2024-2538

HashiCorp Nomad vulnerable to symlink attacks

High Go
Severity
7.7 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.62%
Chance of exploitation in the next 30 days. Higher than 49.56% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-610 Externally Controlled Reference to a Resource in Another Sphere
Fix
1.5.14
Upgrade github.com/hashicorp/nomad to this version or later

Description

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.

Affected versions

Go

PackageVulnerableFixed in
github.com/hashicorp/nomad
>= 1.5.13, < 1.5.14
1.5.14
github.com/hashicorp/nomad
>= 1.6.0, < 1.6.7
1.6.7
github.com/hashicorp/nomad
>= 1.7.3, < 1.7.4
1.7.4
github.com/hashicorp/nomad
>= 1.5.13, < 1.5.14
>= 1.6.0, < 1.6.7
>= 1.7.3, < 1.7.4
1.5.14
1.6.7
1.7.4

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/hashicorp/nomad Go → 1.5.14

go
go get github.com/hashicorp/nomad@v1.5.14 && go mod tidy

Severity breakdown

CVSS 3.1 7.7

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

Attack vector
Network
Attack complexity
High
Privileges required
High
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

Weakness

CWE-59: Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

How to prevent it
  • Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-hx53-77qj-8663
HashiCorp Nomad vulnerable to a path traversal
High Also affects github.com/hashicorp/nomad
GHSA-3934-423w-4jq3
HashiCorp Nomad vulnerable to symlink attack
Medium Also affects github.com/hashicorp/nomad
GHSA-rx97-6c62-55mf
Hashicorp Nomad Incorrect Privilege Assignment vulnerability
High Also affects github.com/hashicorp/nomad
GHSA-c3q9-q986-vrwh
Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs
Medium Also affects github.com/hashicorp/nomad
GHSA-hr68-hvgv-xxqf
Hashicorp Nomad Incorrect Privilege Assignment vulnerability
Medium Also affects github.com/hashicorp/nomad
GHSA-2w5v-x29g-jw7j
Hashicorp Nomad Incorrect Authorization vulnerability
High Also affects github.com/hashicorp/nomad
GHSA-25qx-vfw2-fw8r
Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking
Medium Also affects github.com/hashicorp/nomad
GHSA-5mqx-rpxv-mvxj
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration
High Also affects github.com/hashicorp/nomad
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor