HashiCorp Consul-Template Sandbox Path Bypass Vulnerability Allowing Out-of-Sandbox File Access

A sandbox path bypass vulnerability has been identified in the HashiCorp Consul-Template library, affecting versions prior to 0.42.0. The issue arises in the file template helper, where the sandbox_path restriction can be circumvented, potentially allowing the reading of files outside the designated safe directory. This vulnerability creates a time-of-check time-of-use gap, enabling an attacker to exploit symlinks to access unauthorized files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files outside the designated sandbox path, potentially exposing sensitive information.

Remediation

Users are advised to upgrade to Consul-Template version 0.42.0.