Beta9にホストのファイル読み書きの脆弱性、修正版あり
Summary
Beta9で、テナントがワーカーのマシン上のファイルを読み書きできてしまう脆弱性が11月1日に公表されました。利用者を分けて運用している組織は、gatewayとworkerの両方を修正版に更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Beta9で、テナントがワーカーのマシン上のファイルを読み書きできてしまう脆弱性が11月1日に公表されました。利用者を分けて運用している組織は、gatewayとworkerの両方を修正版に更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| beam-cloud | Beta9 gateway |
< 0.1.776 |
0.1.776 |
| beam-cloud | Beta9 worker |
< 0.1.756 |
0.1.756 |
Original description The description as published by the source.
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- package github.com
- package github.com
- patch github.com
- patch github.com
- web github.com
- web github.com
- web github.com