GHSA-h79v-mp93-644r: Relative path traversal in the log export commands in AWS ParallelCluster CLI
The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.
To remediate this issue, users should upgrade to version 3.16.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS ParallelCluster CLIto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user who has write access to the Amazon S3 bucket used for log exports can exploit it by supplying a crafted S3 object key.
Which systems are exposed?
Systems running export-cluster-logs or export-image-logs with AWS ParallelCluster CLI versions earlier than 3.16.0 are affected. The impact occurs on the machine where the export command is executed.
What access or interaction is required for impact?
The attacker needs write access to the relevant log export S3 bucket, and a user must run one of the affected export commands. Files are then written with the privileges of the user running that command.
What is the immediate remediation?
Upgrade AWS ParallelCluster CLI to version 3.16.0 or later.