GHSA-992g-9cr3-vm5x: Medium severity go/github.com/hatchet-dev/hatchet vulnerability
Cross-tenant disclosure risk on DurableTask bidi RPC
This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via the handleWorkerStatus polling path.
Impact
This advisory requires an attacker to successfully guess a durable task's external uuid belonging to another tenant. External ids are generated uuid v4s (uuid.New() in Go), so exploitation requires prior knowledge of a target task UUID through an out-of-band channel. Thus, while the following environments are impacted, there is an extremely low probability it would be exploited.
Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance:
Hatchet Cloud (multi-tenant SaaS) Self-hosted Hatchet with multiple internal teams / business units sharing one instance Any deployment where a single tenant's API token can be obtained by an attacker
Single-tenant self-hosted deployments are unaffected in practice (the "victim" and "attacker" tenants would be the same).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hatchet-dev/hatchetto a version that resolves this vulnerability.Fixed in 0.106.1
Event History
Frequently Asked Questions
Which deployments are meaningfully exposed?
Deployments hosting multiple tenants on the same Hatchet instance are impacted, including Hatchet Cloud and self-hosted instances shared by multiple teams or business units. A single-tenant self-hosted deployment is unaffected in practice because the attacker and victim would be in the same tenant.
What does an attacker need to exploit this issue?
The attacker needs a single tenant's API token and prior out-of-band knowledge of another tenant's durable task UUID. Task IDs are UUID v4 values, so successfully guessing a target UUID is considered extremely unlikely.
What information could be disclosed?
The affected polling path can return node and branch IDs identifying records in another tenant's durable task event log. The provided data describes this as a cross-tenant data exposure with low confidentiality impact.