zalando / skipper / 21073880822

78%

push

github

security: disable lua scripting by default (#3830)

There is a weakness that can be abused by a default skipper installation
such that you can read arbitrary files as skipper process. It depends on
the custom installation and environment if this is actually exploitable
by untrusted people. Since 2022 we provide a detailed Lua [config
guide](https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources)
such that operators can choose how to use Lua even in less trusted
environments. For example you can use -lua-sources=file and only
operators that can provide a file accessible to the skipper process are
able to reference lua sources and execute provided scripts.

Thanks defang bo providing us a detailed report how to exploit this
vulnerability that is available by default in skipper versions <v0.23

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

3 of 12 new or added lines in 2 files covered. (25.0%)

24594 of 31372 relevant lines covered (78.39%)

95447.02 hits per line