| Package | Affected versions | Patched versions |
|---|---|---|
| borgbackup | ≥ 2.0.0b1, < 2.0.0b22< 1.4.5 | 2.0.0b221.4.5 |
A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd").
When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory.
In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory.
When extracting such an item, borg would hard-link the outside and the inside item.
Note: that sounds bad, but it is no big issue in practice: to create such a malicious archive, the attacker would need repository access and (for encrypted or authenticated repos) also the borg key and passphrase.
Affected: likely all borg releases before 1.4.5 (and also all borg 2.0.0 betas before b22).
For encrypted or authenticated repositories, do not share borg key and passphrase with potential attackers.
For all kinds of repositories, do not share repository access with potential attackers. Usually, the repository access is protected by means outside of borg; e.g. a ssh key for remote repositories or physical access to local storage media.
This issue was first discovered by AI in a private code security review initiated by @ThomasWaldmann.
A few days later, it was also independently reported to @ThomasWaldmann by:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free