Exploit for CVE-2026-52832

## https://sploitus.com/exploit?id=23CA9F8D-9EC6-52FE-8C97-A95BCCD32C68
# CVE-2026-52832-PoC-exploit-nuclio-dashboard
Nuclio Dashboard (NOP mode) accepts unauthenticated POST /api/functions. The spec.handler field isn't path-validated, so ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join, letting an attacker write arbitrary content to any path as root. (CVE-2026-52832, ≤1.15.27)
# CVE-2026-52832 Nuclio Dashboard Path Traversal → Arbitrary File Write

Unauthenticated arbitrary file write (as root) in Nuclio Dashboard via path traversal in `spec.handler`.

| | |
|---|---|
| CVE | CVE-2026-52832 |
| GHSA | GHSA-wpcj-rmv4-86qg |
| Affected | Nuclio ≤ 1.15.27 |
| Fixed | 1.16.5 (PR #4143, commit `2a55d3a`) |
| Class | CWE-22 Path Traversal → Arbitrary File Write |
| CVSS | 7.5 High (`AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`) |

## Summary

Nuclio Dashboard in default `NOP` auth mode accepts `POST /api/functions` without authentication. The `spec.handler` field (`module:entrypoint`) is not path-validated, so a value like `../../../../tmp/x.txt:handler` escapes the build tempdir via `path.Join(tempDir, moduleFileName)`, letting an attacker write arbitrary base64 content (`spec.build.functionSourceCode`) to any path in the Dashboard container. The process runs as `uid=0 (root)`.

## Lab Setup

Vulnerable target:
\`\`\`
docker run -d --name nuclio-vuln -p 127.0.0.1:8070:8070 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  quay.io/nuclio/dashboard:1.15.27-amd64
\`\`\`

Patched control:
\`\`\`
docker run -d --name nuclio-patched -p 127.0.0.1:8071:8070 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  quay.io/nuclio/dashboard:1.16.5-amd64
\`\`\`

Wait until `curl http://127.0.0.1:8070/api/functions` returns `200 {}`.

## Run on a local target

\`\`\`
./poc/poc.sh http://127.0.0.1:8070 nuclio-vuln
\`\`\`

Expected: `[+] SUCCESS` an innocuous marker file is written outside the build tempdir, owned by root.

Against the patched image the same request is rejected with `HTTP 500` and `Handler module name resolves outside the build directory`, and no file is created.

## Example : Run locally with Docker
# 1. start vulnerable target
docker run -d --name nuclio-vuln -p 127.0.0.1:8070:8070 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  quay.io/nuclio/dashboard:1.15.27-amd64

# 2. wait until it answers
curl http://127.0.0.1:8070/api/functions   # expect: {}

# 3. run
chmod +x poc.sh
./poc.sh http://127.0.0.1:8070 nuclio-vuln

## Impact

An unauthenticated network attacker can create or overwrite any file with arbitrary content in the Dashboard container's filesystem as root.

## Remediation

Upgrade to Nuclio ≥ 1.16.5, which adds `common.IsPathWithinDir` before `os.WriteFile` in `pkg/processor/build/builder.go`. Additionally: enable authentication instead of `NOP`, restrict network access to the Dashboard, and avoid mounting the Docker socket where not required.

## Disclaimer

For authorized security research and defensive purposes only. The included PoC writes only a harmless timestamped marker file. Do not run against systems you do not own or have permission to test.