Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking

Root

Cause CVE-2024-7625 is a vulnerability in HashiCorp Nomad and Nomad Enterprise where the archive unpacking process fails to properly handle multiple archive headers targeting the same file during migration of allocation directories [1]. This allows writes outside the intended allocation directory when streaming allocation directories do not remove existing files in paths within the same allocation directory before unpacking [2].

Exploitation

An attacker must first gain access to or compromise the Nomad client agent at the source allocation [1]. With this prerequisite, the attacker can craft a malicious archive that, when unpacked during allocation migration, writes files to paths outside the allocation directory [2]. The vulnerability affects Nomad versions from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2 [1].

Impact

Successful exploitation allows an attacker with control over the source allocation to write files outside the allocation directory on the target client, potentially leading to arbitrary file write or escape from the allocation sandbox [2]. The exact impact depends on the permissions of the Nomad client process.

Mitigation

HashiCorp has fixed this vulnerability in Nomad 1.6.14, 1.7.11, and 1.8.3 [1][2]. Users are advised to upgrade to these versions or later. No workarounds are mentioned.