Arbitrary file read from Cloudflare Pages build environment

Summary

Cloudflare Pages provides users a feature to set redirects and headers in their Pages website. Due to a vulnerability in this feature, it was discovered that an attacker could escalate privileges to root during the build process, which would have enabled them to read filesystem files which he would otherwise be unable to. Cloudflare's engineering team resolved the issue by implementing more restrictive input validation on the redirects and headers feature, however it is important to note that the build environment is scoped to each Pages project, so an attacker could not arbitrarily read files of other project or users.

Using this vulnerability, we found two more vulnerabilities, which allowed us to read files of other projects or tamper with other projects. For the details about the chains of vulnerabilities, please refer to the following articles:

• English: https://ec0.io/post/hacking-cloudflare-pages-part-2/
• Japanese: https://blog.ryotak.net/post/cloudflare-pages-privesc-and-page-tampering/