GHSA-wpcj-rmv4-86qg: Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Summary Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. During function build, writeFunctionSourceCodeToTempFile() passes the module name directly to path.Join(tempDir, moduleFileName). Go's path.Join internally calls path.Clean, which resolves ../ sequences and allows the resolved path to escape tempDir. The function then calls os.WriteFile at the attacker-controlled path with attacker-controlled content (base64-decoded spec.build.functionSourceCode). The write executes in the Dashboard container process running as uid=0 (root), allowing writes to any filesystem location the process can access: /tmp, /etc, /usr/local/bin, /etc/cron.d, and more. - CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — 7.5 (High) - CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) - Affected versions: Nuclio <= 1.15.27 (latest at time of research, dynamically verified) Details Root Cause The vulnerability spans three functions. The path from user input to disk write is: 1. ParseHandler — no path validation (pkg/functionconfig/handler.go:25-38): // pkg/functionconfig/handler.go:25-38 func ParseHandler(handler string) (string, string, error) { moduleAndEntrypoint := strings.Split(handler, ":") switch len(moduleAndEntrypoint) { case 1: return "", moduleAndEntrypoint[0], nil case 2: // Returns moduleFileName verbatim — no path sanitization return moduleAndEntrypoint[0], moduleAndEntrypoint[1], nil default: return "", "", errors.Errorf("Invalid handler name %s", handler) } } Input "../../../../tmp/vul007_proof.txt:handler" returns moduleFileName = "../../../../tmp/vul007_proof.txt". 2. writeFunctionSourceCodeToTempFile — unsafe path construction (pkg/processor/build/builder.go:613-661): // builder.go:624-657 (abridged) tempDir, err :=