title: Nomad Vulnerable to Arbitrary Write Through Symlink Attack
description: HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.
problem types: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
affected:
{
vendor: HashiCorp
product: Nomad
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
repo: https://github.com/hashicorp/nomad
versions:
status: affected, version: 0, lessThanOrEqual: 1.5.13, versionType: semver
status: affected, version: 0, lessThanOrEqual: 1.6.6, versionType: semver
status: affected, version: 0, lessThanOrEqual: 1.7.3, versionType: semver
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Nomad Enterprise
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
versions:
status: affected, version: 0, lessThanOrEqual: 1.5.13, versionType: semver
status: affected, version: 0, lessThanOrEqual: 1.6.6, versionType: semver
status: affected, version: 0, lessThanOrEqual: 1.7.3, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
]