Insecure temporary file in Netflix OSS Hollow
ID: NFLX-2021-001 Title: Local information disclosure in Hollow Release Date: 2021-03-23 Credit: Security Researcher @JLLeitschuh
Overview
Security researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.
Impact
An attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.
Description
Since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
Workarounds and Fixes
Avoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.netflix.hollow:hollow | <= 6.1.0 | no fix |
References
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-377- Platform
- Java / Kotlin (Maven)
- Package
com.netflix.hollow:hollow- Disclosed
- 29.03.2021
- Updated
- 11.10.2026 11:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9295-mhf3-v33m - CC BY 4.0
Vulnerability history: com.netflix.hollow:hollow
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.