Executive brief
Cloudflare Wrangler is a command-line tool used by developers to build and deploy serverless applications on Cloudflare Workers. An attacker on the same local network as a developer running the local development server could bypass directory restrictions and read files outside the intended project directory, potentially exposing sensitive source code, configuration files, or other confidential data.
Technical details
The vulnerability is a directory traversal (path traversal) flaw in Wrangler's local development server used by the `wrangler pages dev` command. An attacker on the same network (adjacent attack vector) can exploit this by crafting requests with path traversal sequences (e.g., ../) to escape the designated development directory and access arbitrary files on the developer's system. The vulnerability requires user interaction (the developer must have the local server running) but no special privileges or authentication. An attacker can achieve high confidentiality impact by reading sensitive files. The issue has been patched in Wrangler v2.20.1 and v3.1.1.
Affected products
- Cloudflare Wrangler < 2.20.1 and < 3.1.1
Timeline
- 2023-08-03: disclosed
- 2023-08-03: patched: Fixed in Wrangler v2.20.1 and v3.1.1