Executive Summary

This vulnerability exists in Kestra, an open-source event-driven orchestration platform, specifically in its local internal-storage backend before versions 1.0.45 and 1.3.23.

The issue arises because the backend validates user-supplied file paths for directory traversal sequences (like "..") before converting Windows-style backslashes (\) to forward slashes (/). An attacker can exploit this by using backslashes to bypass the traversal validation.

After validation, the path is rewritten to include traversal sequences (e.g., ../../../), allowing the attacker to access files outside the intended storage sandbox.

Any authenticated user with the lowest privilege role (able to view an execution) can use a specific API call (GET /api/v1/{tenant}/executions/{executionId}/file?path=…) to read any file on the server filesystem that the Kestra process can read, including sensitive files like the embedded H2 database, secrets, and environment variables.

This results in a complete breach of Kestra's storage isolation and multi-tenancy boundaries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user with minimal privileges to read any file on the server that Kestra can access.

The attacker can access sensitive data such as all stored flows, all users' data, stored secrets, secret files mounted on the system, and environment variables containing database and secret-backend credentials.

This can lead to unauthorized disclosure of confidential information, compromise of other tenants' data in a multi-tenant environment, and potential further exploitation using the stolen credentials.

Overall, it represents a serious security breach impacting confidentiality and isolation guarantees.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Kestra to version 1.0.45 or 1.3.23 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any authenticated user with the lowest privilege to read any file on the server filesystem accessible by the Kestra process, including sensitive data such as stored secrets, database contents, and environment variables containing credentials.

Such unauthorized access to sensitive information can lead to breaches of confidentiality and data protection requirements mandated by common standards and regulations like GDPR and HIPAA.

Therefore, this vulnerability compromises the storage isolation and multi-tenancy boundaries, potentially resulting in non-compliance with these regulations due to exposure of personal data and protected health information.

Useful 0 Not Useful 0