bytedance / Elkeid

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.
https://elkeid.bytedance.com
2.23k stars 432 forks source link

FIXME: directory traversal vulnerability in agent codepath #620

Closed shenping-bd closed 4 months ago

shenping-bd commented 4 months ago

Function Load() could be used to overwrite any files with user-controlled input of plugin name.

Before downloading, must validation the target path and restrict the directory where the plugins are to be stored.