HashiCorp Nomad and Nomad Enterprise Arbitrary File Read/Write Vulnerability on Client Host

A vulnerability allowing arbitrary file read and write on the client host has been identified in HashiCorp Nomad and Nomad Enterprise versions prior to 2.0.1. This issue arises from a symlink attack, where an attacker can manipulate named pipe symlinks for a workload's log files. As a result, the attacker gains access to the host's filesystem with the privileges of the Nomad process user. This vulnerability is particularly concerning because it exploits the filesystem isolation of Nomad task drivers, potentially leading to unauthorized access or modification of files on the client host.

Impact

Exploitation of this vulnerability allows for arbitrary file read and write operations on the client host, using the permissions of the Nomad process user.

Remediation

Users are advised to upgrade to Nomad 2.0.1, 1.11.5, 1.10.11, or newer.