Description
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| uber | kraken | ≤ 0.1.29 | — |
References
- GitHub Issue #645 issue-tracking
- https://github.com/uber/kraken product
- DockerTagPather.BlobPath joins the repo and tag with no validation technical-description
- the testfs backend joins the entry with no traversal check technical-description
- the tag read routes carry no authentication middleware technical-description
- VulnCheck Advisory: Uber Kraken through 0.1.29 Path Traversal via tag parameter third-party-advisory