VU#553375 - Wolfram Cloud /tmp Race Enables RCE & Priv-Esc

CERT/CC VU#553375 details a Wolfram Cloud 14.2 issue where the JVM has unrestricted access to shared /tmp resources in multi-tenant instances, enabling privilege escalation, information exfiltration, and potential remote code execution via classpath poisoning during JVM initialization (T1068, T1059). Attackers who can time JVM launches may inject malicious classes from shared temp paths. Because the shared /tmp is accessible between users on the same instance, race conditions can expose other tenants’ temporary directories, undermining isolation. While temporary files typically lack sensitive data, JVM init artifacts and classpath manipulation create a practical execution avenue. Business risk: hosted notebook environments and educational tenants face cross-tenant compromise and data leakage. This threatens research IP and student privacy and can be chained with social engineering or weak ACLs. Mitigation: update Wolfram Cloud to v14.2.1; harden temp directory permissions and isolate JVM init files; monitor for unexpected classpath entries and abnormal JVM flags; and apply strict multi-tenant isolation controls within hosting platforms.