CVE-2024-6717

What it actually does

Archive unpacking during migration permits path traversal that escapes the allocation directory, allowing files to be written outside the intended boundaries.

Why it matters to the business

Attackers with limited access could alter or overwrite critical files in the allocation directory, risking cluster integrity and requiring urgent patching given the July 2024 disclosure and low but persistent exploit probability.

How an attack unfolds

An attacker with migration privileges crafts a malicious archive containing path traversal sequences; during Nomad's unpacking step the archive writes files outside the allocation directory, enabling unauthorized modification of system or job files.

How to fix it

Upgrade Nomad to 1.6.13, 1.7.10, or 1.8.2. For xibosignage/xibo-cms (GIT) apply the fix in commit b7a5899338cd841a39702e3fcaff76aa0ffe4075. Validate no custom migration scripts bypass unpacking safeguards.

How to confirm the fix worked

Confirm installed version is 1.6.13+, 1.7.10+, or 1.8.2+; test migration with a crafted archive containing traversal paths and verify files remain confined to the allocation directory.

Typical attack path

1. Obtain low-privileged Nomad credentials or migration rights
2. Prepare archive with ../ sequences targeting files outside allocation directory
3. Trigger migration or archive unpacking operation
4. Verify files written to unintended locations and leverage for further impact

How to detect it

Review Nomad migration and unpacking logs for archive operations; look for unexpected file paths containing .. sequences or writes outside standard allocation directories.

What your security team should do

• Immediately upgrade all Nomad instances to the fixed releases
• Audit migration workflows and archive sources for untrusted input
• Monitor for unusual file writes outside allocation paths post-upgrade