# Worker container escape lead to arbitrary file reading in host machine

Worker container could replace build.log with a symlink so the host's post-job copy followed it and read host files like /etc/passwd.

- Payout: $2,000
- Severity: critical
- Program: Semmle
- Credited: testanull
- Disclosed: 2019-10-16
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/694181
- Library page: https://bugbountylibrary.com/r/h1%3A694181
- Tags: domain:infra impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:docker technique:chained vuln:info-disclosure vuln:path-traversal vuln:privilege-escalation

**Target:** LGTM build worker container log extraction pipeline
**Root cause:** Host copies build.log out of the container after the job without validating it is a regular file, so a symlink planted by the job is followed on the host filesystem.
**Steps:**
1. Configure extraction step to run `rm -rf /opt/out/snapshot/log/build.log && ln -s /etc/passwd /opt/out/snapshot/log/build.log`
2. Submit job so worker container executes the after_prepare command
3. Host post-job copy follows the symlink and reads /etc/passwd from the host
4. Retrieve copied log containing host file contents
**How found:** Noticed the host copies build.log from the container after job completion and reasoned that a symlink would be resolved on the host rather than inside the container.
**Exploitation:** Attacker controls build config in the worker container, deletes the expected log path and replaces it with a symlink to a host path; the host-side copy routine dereferences the symlink against the host filesystem, exfiltrating arbitrary host files via the returned log.
**Insight:** When a privileged host copies files out of an untrusted container, test whether symlinks are dereferenced host-side; replace expected output paths with symlinks to sensitive host files.