Path Traversal in kedro-datasets via MatplotlibDataset.save()

Executive Summary

kedro-datasets versions 9.3.0 through 9.6.0 have a path traversal flaw in MatplotlibDataset.save(). Attackers can write files outside the dataset directory by providing absolute plot names. The issue occurs because validate_sub_path() removes leading slashes while pathlib.join() ignores the base path, allowing file creation or overwriting anywhere the process can write.

Useful 0 Not Useful 0

Detection Guidance

Check for installed versions of kedro-datasets between 9.3.0 and 9.6.0 using pip list or pip show kedro-datasets. Review logs for MatplotlibDataset.save() calls with absolute paths in plot names. Inspect filesystem for unexpected files outside dataset directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker could overwrite critical system files, inject malicious code into applications, or replace configuration files. This could lead to remote code execution, data corruption, or denial of service if the process has write permissions to sensitive directories.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes outside intended directories, potentially exposing sensitive data stored in those locations. For GDPR, this may violate principles of data protection by design and default if personal data is compromised. For HIPAA, unauthorized file access could result in breaches of protected health information if such data is written to insecure locations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade kedro-datasets to version 9.6.1 or later. If upgrading is not possible, avoid using absolute paths in MatplotlibDataset.save() plot names. Validate all user inputs to prevent path traversal sequences.

Useful 0 Not Useful 0