Windmill (versions prior to 1.603.3)

The filename parameter passed to the get_log_file endpoint was concatenated directly into a file path with no sanitisation checks. The server trusted whatever string the user supplied and opened the corresponding file. Version 1.603.3 adds input sanitisation to block traversal sequences.

An attacker sends a crafted unauthenticated request to /api/w/{workspace}/jobs_u/get_log_file/{filename}, substituting the filename for a traversal string such as ../../../proc/1/environ. The server returns the contents of that file. If SUPERADMIN_SECRET is present in that environment file, the attacker uses it as a Bearer token to authenticate as superadmin and execute arbitrary code. Active exploitation has targeted /etc/passwd for credential reconnaissance.

1. Look for HTTP requests to /api/w/*/jobs_u/get_log_file/ containing ../ or %2e%2e sequences in server access logs.
2. Monitor for unexpected reads of /etc/passwd or /proc/1/environ in file access logs.
3. Alert on any Bearer token authentication from IP addresses that have not previously logged in.

1. Upgrade Windmill to version 1.603.3 or later immediately.
2. Restrict public internet access to the Windmill management interface.
3. Rotate the SUPERADMIN_SECRET value and audit recent superadmin session activity.