Backup Restoration Symbolic Link Handling Vulnerability (Path Traversal/File Overwrite) with Patch Details

Vulnerability Overview This vulnerability concerns the handling of unsafe symbolic links during the backup restoration process. Specifically, when restoring backups, the extracted restoration contents are not validated, which may lead to the replacement of existing files, thereby causing security issues. Scope of Impact Backup Restoration Functionality: All systems or applications utilizing backup restoration features. File Operations: Operations involving file copying, moving, and deletion. Symbolic Links: Particularly those pointing to external directories or files. Remediation Steps 1. Validate Restoration Contents: Before restoring backups, validate the extracted contents to ensure their safety. 2. Limit Concurrent Operations: Restrict concurrent operations to 16 to reduce potential security risks. 3. Code Modifications: - Add validation logic for restoration contents in the file. - Modify the method to ensure security checks are performed on file paths during extraction. - Add validation for the restoration directory in the method to ensure existing files are not replaced. POC Code The following are examples of relevant code modifications: ```typescript // backup-manager.ts import { sanitizeFilename } from '@common/helpers/file-helpers'; import { ArchiveService } from '@core/archive/archive.service'; import { ConfigurationService } from '@core/config/configuration.service'; import { FilesystemService } from '@core/filesystem/filesystem.service'; export class BackupManager { private async validateRestoreDirectory( directory: string, options: { allowSymlinks: boolean; optional?: boolean; rejectHardLinks: boolean } ): Promise { const directoryStats = await this.filesystem.lstat(directory).catch((error: NodeJS.ErrnoException) => { if (options.optional && error.code === 'ENOENT') { return null; } throw error; }); if (directoryStats) { if (directoryStats.isDirectory()) { return; } throw new Error('Backup contains unsupported file types'); } } private async runValidationOperation( operation: () => Promise, runValidationForOperation: boolean ): Promise { if (runValidationForOperation) { await this.validateRestoreDirectory(path.join(restoreDir, 'app-data'), { allowSymlinks: true }, undefined); await this.validateRestoreDirectory(path.join(restoreDir, 'app'), { allowSymlinks: true, rejectHardLinks: true }, undefined); await this.validateRestoreDirectory(path.join(restoreDir, 'user-config'), { allowSymlinks: false, rejectHardLinks: true, optional: true }, undefined); } await operation(); } public async restoreApp(appDir: string, backupPath: string): Promise { const { appInstalledDir, appDataDir } = this.appFileManager.getAppPaths(appDir); const { userConfigDir } = this.appFileManager.getUserConfigPaths(appDir); // Remove old data directories await this.filesystem.removeDirectory(appDataDir); await this.filesystem.removeDirectory(appInstalledDir); await this.filesystem.removeDirectory(userConfigDir); // Remove old app directories await this.filesystem.removeDirectory(appDataDir); await this.filesystem.removeDirectory(appInstalledDir); await this.filesystem.removeDirectory(userConfigDir); // Create directories await this.filesystem.createDirectory(appDataDir); await this.filesystem.createDirectory(appInstalledDir); await this.filesystem.createDirectory(userConfigDir); await this.filesystem.createDirectory(appDataDir); await this.filesystem.createDirectory(appInstalledDir); await this.filesystem.createDirectory(userConfigDir); // Copy data from the backup folder await this.filesystem.copyDirectory(path.join(restoreDir, 'app-data'), appDataDir); await this.filesystem.copyDirectory(path.join(restoreDir, 'app'), appInstalledDir); // Copy data from the backup folder await this.filesystem.copyDirectory(path.join(restoreDir, 'app-data'), appDataDir); await this.filesystem.copyDirectory(path.join(restoreDir, 'app'), appInstalledDir); // Handle user-config directory if (await this.filesystem.isDirectory(path.join(restoreDir, 'user-config'))) { await this.filesystem.copyDirectory(path.join(restoreDir, 'user-config'), userConfigDir); } if (await this.filesystem.isDirectory(path.join(restoreDir, 'user-config'))) { await this.filesystem.copyDirectory(path.join(restoreDir, 'user-config'), userConfigDir); } if (await this.filesystem.isDirectory(path.join(restoreDir, 'user-config'))) { await this.filesystem.copyDirectory(path.join(restoreDir, 'user-config'), userConfigDir); } if (await this.filesystem.isDirectory(path.join(restoreDir, 'user-config'))) { await this.filesystem.copyDirectory(path.join(restoreDir, 'user-config'), userConfigDir); } if (await this.filesystem.isDirectory(path.join(restoreDir, 'user-config'))) { await this.filesystem.copyDirectory(path.join(restoreDir, 'user-config'), userConfigDir); } if (await this.filesystem.isDirectory(path.join(restoreDir, 'user-config'))) { await this.filesystem.copyDirectory(path.join(restoreDir, 'user-config'), userConfigDir); } if (await this.filesystem.isDirectory(path.join(rest

Goal Reached Thanks to every supporter — we hit 100%!

Backup Restoration Symbolic Link Handling Vulnerability (Path Traversal/File Overwrite) with Patch Details

More from this source