Worker container escape lead to arbitrary file reading in host machine
该报告还没有中文解读。
原文摘录
摘自原文（888 字符中的一小部分）
Summary: Because lack of security, attacker will be able to remove original log file and replace it will a symlink to other file, After finishing job, host machine copy file from docker container. Because the original log file has been removed, the host machine will copy the symlink file. But the …
原文中的代码
cpp:
after_prepare:
- rm -rf /opt/out/snapshot/log/build.log && ln -s /etc/passwd /opt/out/snapshot/log/build.log默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Semmle 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @testanull · 版权归作者与 Semmle 所有