Privilege escalation to root in Pages build image v2
Low
C
Cloudflare Public Bug Bounty
Submitted None
Team Summary
Official summary from Cloudflare Public Bug Bounty
Due to a user-readable directory in the Cloudflare Pages build process (v2), an attacker could replace the contents of 2 executable files (that are executed during the build process) present in this directory with arbitrary content, leading to potential root access to the container running the build. While all the keys were scoped to allow access to the user's own Pages site data and not the data of others, Cloudflare's Engineering team chose to remediate the issue by tightening permissions on the file system.
Actions:
Reported by
albertspedersen
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$350.00
Submitted
Weakness
Privilege Escalation