Cloudflare Public Bug Bounty · Report #1979372
Privilege escalation to root in Pages build image v2
Summary
Due to a user-readable directory in the Cloudflare Pages build process (v2), an attacker could replace the contents of 2 executable files (that are executed during the build process) present in this directory with arbitrary content, leading to potential root access to the container running the build. While all the keys were scoped to allow access to the user's own Pages site data and not the data of others, Cloudflare's Engineering team chose to remediate the issue by tightening permissions on the file system.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.