Relevant Products/Components:
trestle/core/commands/author/jinja.pytrestle author jinja
Detailed Description:
The -o/--output argument in trestle author jinja allows writing files outside the intended workspace.
The application does not properly validate:
This allows arbitrary file write to attacker-controlled locations.
Vulnerable code:
output_file = trestle_root / r_output_file
An attacker can overwrite files such as:
.github/workflows/*.yml.git/hooks/*- user writable config files
This can lead to CI/CD compromise or local code execution.
Steps To Reproduce:
- Clone the repository:
git clone https://github.com/oscal-compass/compliance-trestle.git
cd compliance-trestle
- Create template:
echo "hello" > template.j2
- Run:
trestle author jinja -i template.j2 -o "subdir\..\..\..\..\..\poc.txt"
- Observe:
The file is written outside the repository workspace.
Browsers Verified In:
Not browser related.
Tested on:
Supporting Material/References:
Affected file:
trestle/core/commands/author/jinja.py
Successfully verified:
- directory traversal using
../
- Windows traversal using
..\
- arbitrary file write outside workspace
Access Vector Required for Exploitation:
Local
Vulnerability Exists in Default Configuration?:
Yes
Is the exploitation trivial or does it involve a multi-step process that may depend on user/victim interaction?:
Trivial.
Single command execution.
Exploitation Requires Authentication?:
No
Under what privileges does the vulnerable service or component run?:
Runs with privileges of the user executing the trestle command.
Impact
An attacker can write files outside the intended workspace directory and overwrite sensitive files writable by the current user.
Possible impacts include:
- overwriting
.github/workflows/*.yml to execute attacker-controlled GitHub Actions workflows
- overwriting
.git/hooks/* for local code execution
- modifying user configuration files such as
.bashrc
- tampering with repository files and generated compliance artifacts
In CI/CD environments, this may result in execution of attacker-controlled commands on build runners.
References
l3tchupkt Reporter
Relevant Products/Components:
trestle/core/commands/author/jinja.pytrestle author jinjaDetailed Description:
The
-o/--outputargument intrestle author jinjaallows writing files outside the intended workspace.The application does not properly validate:
../..\This allows arbitrary file write to attacker-controlled locations.
Vulnerable code:
An attacker can overwrite files such as:
.github/workflows/*.yml.git/hooks/*This can lead to CI/CD compromise or local code execution.
Steps To Reproduce:
git clone https://github.com/oscal-compass/compliance-trestle.git cd compliance-trestleThe file is written outside the repository workspace.
Browsers Verified In:
Not browser related.
Tested on:
Supporting Material/References:
Affected file:
Successfully verified:
../..\Access Vector Required for Exploitation:
Local
Vulnerability Exists in Default Configuration?:
Yes
Is the exploitation trivial or does it involve a multi-step process that may depend on user/victim interaction?:
Trivial.
Single command execution.
Exploitation Requires Authentication?:
No
Under what privileges does the vulnerable service or component run?:
Runs with privileges of the user executing the
trestlecommand.Impact
An attacker can write files outside the intended workspace directory and overwrite sensitive files writable by the current user.
Possible impacts include:
.github/workflows/*.ymlto execute attacker-controlled GitHub Actions workflows.git/hooks/*for local code execution.bashrcIn CI/CD environments, this may result in execution of attacker-controlled commands on build runners.
References