GHSA-4hhf-mfx9-3877: Path traversal in Amazon Braket SDK local hybrid job input data download
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.
We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amazon-braket-sdkto a version that resolves this vulnerability.Fixed in 1.127.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated write access to the S3 location used for a hybrid job's input data. They can then use crafted S3 object keys during local hybrid job input-data download.
What is the impact on a vulnerable local hybrid job?
A successful exploit can overwrite arbitrary files with the privileges of the user running the job. The advisory identifies integrity and availability impact, rather than confidentiality impact.
What versions should be remediated?
Upgrade Amazon Braket SDK to version 1.127.7 or later. Versions before 1.127.7 are affected.
What can be done if an upgrade is not immediately possible?
Restrict S3 write access to the hybrid job input-data location to trusted principals. This reduces the ability of an authenticated attacker to place crafted object keys.