HexBrain

Cloudflare Public Bug Bounty · Report #1979372

Privilege escalation to root in Pages build image v2

Validstatus
lowseverity
$350bounty
10upvotes
26 May 2023disclosed

Summary

Due to a user-readable directory in the Cloudflare Pages build process (v2), an attacker could replace the contents of 2 executable files (that are executed during the build process) present in this directory with arbitrary content, leading to potential root access to the container running the build. While all the keys were scoped to allow access to the user's own Pages site data and not the data of others, Cloudflare's Engineering team chose to remediate the issue by tightening permissions on the file system.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original