PT-2023-28701 · Buildkit · Buildkite Elastic Ci For Aws

Published 2023-12-22 · Updated 2024-01-03 · CVE-2023-43116

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Buildkite Elastic CI for AWS versions prior to 6.7.1 Buildkite Elastic CI for AWS versions prior to 5.22.5

Description A symbolic link following issue allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE PATH variable in the fix-buildkite-agent-builds-permissions script.

Recommendations For versions prior to 6.7.1, update to version 6.7.1 or later. For versions prior to 5.22.5, update to version 5.22.5 or later. As a temporary workaround, consider restricting access to the fix-buildkite-agent-builds-permissions script until a patch is available. Avoid using the PIPELINE PATH variable in the affected script until the issue is resolved.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2023-43116

GHSA-7C44-7J7V-W554

Affected Products

Buildkite Elastic Ci For Aws

References · 7

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-43116 · Security Note
• https://osv.dev/vulnerability/GHSA-7c44-7j7v-w554 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43116 · Vendor Advisory
• https://github.com/buildkite/elastic-ci-stack-for-aws · Note
• https://github.com/buildkite/elastic-ci-stack-for-aws/commit/8f79882b6aa18fb8fc61f10c7047d2907b7a2f69 · Note
• https://t.me/cvenotify/66010 · Telegram Post