PT-2024-7109 · Hashicorp+1 · Nomad+2

Published 2024-02-08 · Updated 2024-10-15 · CVE-2024-1329

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.5.13 through 1.6.6 and version 1.7.3

Description The template renderer in HashiCorp Nomad and Nomad Enterprise is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This issue allows a remote attacker to potentially execute arbitrary code. The vulnerability is related to incorrect link resolution before accessing a file.

Recommendations For versions 1.5.13 through 1.6.6 and version 1.7.3, update to Nomad 1.7.4, 1.6.7, or 1.5.14 to resolve the issue. As a temporary workaround, consider restricting access to the template renderer to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-610

CWE-59

Related Identifiers

BDU:2024-08392

CVE-2024-1329

GHSA-C866-8GPW-P3MV

GO-2024-2538

Affected Products

Nomad

Nomad Enterprise

Red Os

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2024-1329 · Security Note
• https://bdu.fstec.ru/vul/2024-08392 · Security Note
• https://ubuntu.com/security/CVE-2024-1329 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-1329 · Security Note
• https://osv.dev/vulnerability/GHSA-c866-8gpw-p3mv · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/704583 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1329 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1329 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2538 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/commit/b3209cbc6921e703b0e9984ce70c10b378665834 · Note
• https://github.com/hashicorp/nomad/commit/de55da677a21ac7572c0f4a8cd9abd5473c47a70 · Note
• https://github.com/hashicorp/nomad/commit/d1721c7a6fc1833778086603f818a822a34f445a · Note
• https://github.com/hashicorp/nomad/issues/19888 · Note