Path Traversal in Pydantic Settings via Symbolic Links

Executive Summary

The vulnerability exists in pydantic-settings versions 2.12.0 to 2.14.1 in the NestedSecretsSettingsSource component. When the setting secrets_nested_subdir is enabled, the software follows symbolic links inside the configured secrets directory that point to locations outside this directory. This behavior allows reading files outside the intended secrets directory.

Additionally, the vulnerability bypasses the secrets_dir_max_size protection because the size validation ignores symbolic links, while the secret loading process follows them. This inconsistency allows an attacker or lower-privileged user with write access to the secrets directory to read arbitrary local files or bypass size restrictions.

The issue is fixed in version 2.14.2 by preventing following symlinks outside the configured directory and using a consistent directory traversal method.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker or a lower-privileged component with write access to the configured secrets directory to read arbitrary local files outside the intended secrets directory.

Such unauthorized local file reads can expose sensitive information that was not meant to be accessible, potentially leading to information disclosure.

Moreover, the attacker can bypass the size limit protections on the secrets directory, possibly leading to further exploitation or resource exhaustion.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the presence of symbolic links inside the configured secrets directory that point outside of it, which can be exploited to read unintended files.

To detect this vulnerability on your system, you can check for symbolic links within the secrets directory that point outside the directory.

• Use the command: find /path/to/secrets_dir -type l -exec ls -l {} \; to list all symbolic links and their targets.
• Verify if any of these symbolic links point outside the configured secrets directory by examining their target paths.
• Additionally, check if the pydantic-settings version in use is between 2.12.0 and 2.14.1, as these versions are vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade pydantic-settings to version 2.14.2 or later, where the vulnerability is fixed.

In the meantime, ensure that the configured secrets directory does not contain symbolic links pointing outside the directory.

Restrict write access to the secrets directory to trusted users only, preventing attackers or lower-privileged components from creating malicious symlinks.

Review and enforce proper permissions on the secrets directory and any mounts used for secrets to avoid unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with local access and write permissions to the configured secrets directory to read arbitrary files outside the intended secrets directory. Such unauthorized local file reads could lead to exposure of sensitive configuration data or secrets.

Exposure of sensitive data due to this vulnerability could potentially impact compliance with data protection regulations such as GDPR or HIPAA, which require strict controls over access to sensitive information and secrets.

Organizations relying on pydantic-settings for secrets management should upgrade to version 2.14.2 to mitigate this risk and maintain compliance with security best practices mandated by these standards.

Useful 0 Not Useful 0