Arbitrary file read from Cloudflare Pages build environment
Team Summary
Official summary from Cloudflare Public Bug Bounty
Cloudflare Pages provides users a feature to set redirects and headers in their Pages website. Due to a vulnerability in this feature, it was discovered that an attacker could escalate privileges to root during the build process, which would have enabled them to read filesystem files which he would otherwise be unable to. Cloudflare's engineering team resolved the issue by implementing more restrictive input validation on the redirects and headers feature, however it is important to note that the build environment is scoped to each Pages project, so an attacker could not arbitrarily read files of other project or users.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved