alces-flight / flight-diag Goto Github PK

logview, logcat, and logtail all accept the supplied path/filename without canonicalizing or verifying it, making it open to directory traversal circumvention methods.
For example:
flight-diag logview /etc/sudoers resolves to /var/log/etc/sudoers, which is an invalid/not found filename, but flight-diag logview ../../etc/sudoers or flight-diag logview /var/log/../../etc/sudoers both canonicalize to /etc/sudoers, a file outside /var/log that would otherwise by restricted to root only.