Loading HuntDB...

Extraction of Pages build scripts, config values, tokens, etc. via symlinks

Medium
C
Cloudflare Public Bug Bounty
Submitted None

Team Summary

Official summary from Cloudflare Public Bug Bounty

Due to a broader permission set on certain folders within the filesystem structure, a malicious Pages build could leverage symlinks to extract build source/configuration and environment variables. While these variables were scoped to allow access to the user's own Pages site data and not the data of others, Cloudflare's Engineering team chose to remediate the issue by tightening permissions on the file system.

Reported by mattipv4

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$500.00

Submitted

Weakness

Information Disclosure