Access Control Bypass in Kestra Allows File Preview Exploitation

Executive Summary

Kestra is an open-source, event-driven orchestration platform. Before versions 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) had an access control bypass vulnerability. This flaw allowed any authenticated user to read output files from any other execution within the same tenant, effectively bypassing execution-level and namespace-level isolation controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) with an authenticated user account and checking if it is possible to read output files from executions that belong to other users within the same tenant.

A practical way to test this is to use HTTP request tools such as curl or similar to send a GET request to the vulnerable endpoint with different execution IDs that the authenticated user should not have access to. If the response returns file contents from other executions, the system is vulnerable.

• Example curl command to test access: curl -i -H "Authorization: Bearer <token>" "https://<kestra-server>/api/v1/<tenant>/executions/<other_execution_id>/file/preview"
• Replace <token> with a valid authentication token, <kestra-server> with your Kestra server address, <tenant> with your tenant identifier, and <other_execution_id> with an execution ID that belongs to another user.

If the response contains output files from executions not owned by the authenticated user, it indicates the presence of the access control bypass vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive output files from other executions within the same tenant. An attacker with valid authentication could read data they should not have access to, potentially exposing confidential or sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any authenticated user within the same tenant to bypass access controls and read output files from other executions, which compromises execution-level and namespace-level isolation.

Such unauthorized access to potentially sensitive data could lead to violations of data protection regulations like GDPR and HIPAA, which require strict access controls and data confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Kestra to version 1.0.45 or 1.3.21 or later, where the access control bypass issue in the previewFileFromExecution endpoint is fixed.

Useful 0 Not Useful 0