OD-3162: Able to read arbitrary host file via workspace or run image tools step

Able to read arbitrary host file via workspace or run image tools step #3162

Robin Shen opened 3 weeks ago

This happens if untrusted users are allowed to run CI/CD or workspace on any executor or provisioner

Copy

Robin Shen changed title 3 weeks ago

Previous Value	Current Value
Able to read arbitrary host file via workspace or run image tools step	RCE via workspace or run image tools step for any user with project writer permission

Robin Shen changed title 3 weeks ago

Previous Value	Current Value
RCE via workspace or run image tools step for any user with project writer permission	Able to read arbitrary host file via workspace or run image tools step

OneDev commented 3 weeks ago

State changed as build OD-8619 is successful

Copy
OneDev changed state to 'Closed' 3 weeks ago
Previous Value Current Value
Open

Closed
Robin Shen changed confidential 2 weeks ago
Previous Value Current Value
true

false
Login to comment

Previous Value	Current Value
Open	Closed

Previous Value	Current Value
true	false

Issue Votes (0)

Watchers (2)

Reference

OD-3162