GHSA-wpcj-rmv4-86qg Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
SummaryNuclio Dashboard exposes `POST /api/functions` without authentication by default (NOP auth mode). The `spec.handler` field (e.g., `mymodule:myfunction`) is parsed by `functionconfig.ParseHandler()` which splits on `:` only — no path validation is applied to the module portion.During function build, `writeFunctionSourceCodeToTempFile()` passes the module name directly to `path.Join(tempDir, moduleFileName)`. Go's `path.Join` internally calls `path.Clean`, which resolves `../` sequences and allows the resolved path to escape `tempDir`. The function then calls `os.WriteFile` at the attacker-controlled path with attacker-controlled content (base64-decoded `spec.build.functionSourceCode`).The write executes in the Dashboard container process running as `uid=0 (root)`, allowing writes to any filesystem location the process can access: `/tmp`, `/etc`, `/usr/local/bin`, `/etc/cron.d`, and more.**CVSS 3.1**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` — **7.5 (High)****CWE**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)**Affected versions**: Nuclio <= 1.15.27 (latest at time of research, dynamically verified)DetailsRoot CauseThe vulnerability spans three functions. The path from user input to disk write is:**1. `ParseHandler` — no path validation** (`pkg/functionconfig/handler.go:25-38`):Input `"../../../../tmp/vul007_proof.txt:handler"` returns `moduleFileName = "../../../../tmp/vul007_proof.txt"`.**2. `writeFunctionSourceCodeToTempFile` — unsafe path construction** (`pkg/processor/build/builder.go:613-661`):**3. `cleanupTempDir` does not remove the traversal file** (`builder.go:1047-1061`):Path Traversal CalculationThe same technique with 4x `../` reaches any path under `/tmp`, `/etc`, `/usr`, etc.Full Attack ChainPoC — Steps to ReproduceEnvironment SetupThe following steps set up an isolated kind cluster and deploy Nuclio 1.15.27. All commands were executed on an Ubuntu host with Docker 29.1.2.**Step 1: Create isolated kind cluster with Docker socket mounted**The Dashboard container builder requires access to Docker daemon. Create a kind cluster configuration that mounts the host Docker socket into the cluster node:Expected output:Verify Docker socket is available inside the cluster node:**Step 2: Deploy Nuclio via Helm****Step 3: Wait for Dashboard to be ready****Step 4: Expose Dashboard locally****Step 5: Create default project (required by Dashboard API)**Exploitation**Step 6: Send path traversal request**The `handler` field `../../../../tmp/vul007_proof.txt:handler` instructs the build pipeline to write `functionSourceCode` content to `/tmp/vul007_proof.txt` inside the Dashboard container.`functionSourceCode` base64 decoded: `PROVED-PATH-TRAVERSAL-VUL007`Expected response:**Step 7: Observe Dashboard build logs**Actual log output (captured during verification, timestamp 2026-05-17 14:55:02 CST):The log confirms `functionPath` resolved to `/tmp/vul007_proof.txt`, which is
**outside** the tempDir `/tmp/nuclio-build-227825660/source`. Path traversal is confirmed.**Step 8: Verify file written to traversal path**Output:Output:**Step 9: Write to /etc/ — broader impact demonstration**Log evidence:CleanupImpactDirect ImpactAn unauthenticated attacker with network access to the Nuclio Dashboard port can write arbitrary content to any path accessible by the Dashboard process (running as root) inside the Dashboard container.Demonstrated write targets:`/tmp/` — confirmed (primary PoC)`/etc/` — confirmed (secondary PoC)Potential high-impact write targets:`/etc/cron.d/` — write a cron job entry; if a cron daemon runs in the container, this
achieves scheduled arbitrary command execution inside the container`/usr/local/bin/<name>` — overwrite a binary called by dashboard processesAny file path accessible by root within the container filesystemPrivilege EscalationThe Dashboard container runs as `uid=0 (root)`. Its mounted Kubernetes ServiceAccount (`nuclio-dashboard`) holds the following RBAC permissions in the `nuclio` namespace:Verification: Using the SA token directly against the Kubernetes API:An attacker who compromises the Dashboard container (via this file write vulnerability) gains access to this SA token and can create privileged workloads in the `nuclio` namespace, potentially escalating to cluster-level access depending on cluster configuration.ScopeThe file write is bounded to the Dashboard **container** filesystem. Host-level writes require additional preconditions (hostPath volumes, privileged container mode, or DinD configuration) not present in a standard Nuclio Kubernetes deployment.Severity**CVSS 3.1 Score: 7.5 (High)**| Metric | Value | Rationale |
|--------|-------|-----------|
| Attack Vector | Network | Dashboard API reachable over network |
| Attack Complexity | Low | Single HTTP request, no race condition |
| Privileges Required | None | Default NOP auth mode requires no credentials |
| User Interaction | None | Fully automated |
| Scope | Unchanged | Write confined to Dashboard container |
| Confidentiality | None | No data read in primary attack path |
| Integrity | High | Arbitrary file write as root in container |
| Availability | None | No service disruption caused by write |Affected Versions**Nuclio <= 1.15.27** (latest release at time of research)Dynamically verified against `quay.io/nuclio/dashboard:1.15.27-amd64` on 2026-05-17The vulnerable code path (`writeFunctionSourceCodeToTempFile` in `pkg/processor/build/builder.go`)
has been present since the `functionSourceCode` inline code feature was introduced.Patched Versionshttps://github.com/nuclio/nuclio/releases/tag/1.16.5Workarounds**Option 1: Enable authentication on the Dashboard**Set `NUCLIO_AUTH_KIND` to a non-NOP value (e.g., `iguazio`) to require credentials. This prevents unauthenticated access to the API. Consult Nuclio documentation for supported auth providers.**Option 2: Network-level access control**Restrict network access to the Dashboard port (default 8070) to trusted networks only. Do not expose the Dashboard directly to the internet.**Option 3: Drop root privileges in the Dashboard container**Run the Dashboard process as a non-root user to reduce the impact of container-level arbitrary file writes.RemediationAdd a path boundary check in `writeFunctionSourceCodeToTempFile` after constructing `sourceFilePath`:Alternatively, reject any `handler` module name containing path separator characters before the build pipeline is invoked (at API request validation time).ResourcesVulnerable file: `pkg/processor/build/builder.go` — function `writeFunctionSourceCodeToTempFile`, line 654Parser: `pkg/functionconfig/handler.go` — function `ParseHandler`, line 25Go `path.Join` behavior: https://pkg.go.dev/path#JoinCWE-22: https://cwe.mitre.org/data/definitions/22.htmlOWASP Path Traversal: https://owasp.org/www-community/attacks/Path_Traversal
CVSS v3.1 score: 4.9