Dagster Webserver Directory Traversal Vulnerability in Logs Endpoint

A directory traversal vulnerability has been identified in the Dagster webserver component, affecting versions through 1.5.11. This vulnerability allows remote attackers to access sensitive information by sending crafted requests to the /logs endpoint. The issue appears to be limited to certain file names that begin with a dot ('.').

Impact

Exploitation of this vulnerability could lead to unauthorized access to arbitrary files, including sensitive configuration files such as dagster.yaml, which may contain private information.

Reproduction

The vulnerability can be reproduced by sending a GET request to the /logs endpoint with a crafted file path that includes directory traversal sequences (such as '..') and a file name that starts with a dot. For example, the request could be crafted to access the user's .bash_history file.

Remediation

Users can upgrade to Dagster version 1.5.11 or later, where this vulnerability has been fixed.