Loading HuntDB...

Arbitrary file read from Cloudflare Pages build environment

Medium
C
Cloudflare Public Bug Bounty
Submitted None

Team Summary

Official summary from Cloudflare Public Bug Bounty

Cloudflare Pages provides users a feature to set redirects and headers in their Pages website. Due to a vulnerability in this feature, it was discovered that an attacker could escalate privileges to root during the build process, which would have enabled them to read filesystem files which he would otherwise be unable to. Cloudflare's engineering team resolved the issue by implementing more restrictive input validation on the redirects and headers feature, however it is important to note that the build environment is scoped to each Pages project, so an attacker could not arbitrarily read files of other project or users.

Reported by ryotak

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted