Beta9 Gateway
Monthly
Path traversal in the Beta9 gateway and worker lets a tenant holding a valid workspace token deploy a function, endpoint, or task queue with a volume identifier containing '..' segments, collapsing the gateway-built host path to the worker's filesystem root and bind-mounting it read-write into the sandbox. This allows an authenticated attacker to read and write the worker's files, including other tenants' volumes colocated on the same machine; CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with scope change. Gateway 0.1.769 and worker 0.1.745 are confirmed vulnerable, with fixes released in gateway 0.1.776 and worker 0.1.756; no public exploit code was identified at time of analysis, but the vendor-supplied patch details are public and the priority label is act_now.
Path traversal in the Beta9 gateway and worker lets a tenant holding a valid workspace token deploy a function, endpoint, or task queue with a volume identifier containing '..' segments, collapsing the gateway-built host path to the worker's filesystem root and bind-mounting it read-write into the sandbox. This allows an authenticated attacker to read and write the worker's files, including other tenants' volumes colocated on the same machine; CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with scope change. Gateway 0.1.769 and worker 0.1.745 are confirmed vulnerable, with fixes released in gateway 0.1.776 and worker 0.1.756; no public exploit code was identified at time of analysis, but the vendor-supplied patch details are public and the priority label is act_now.