VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.146.0, 1.136.12, 1.122.25
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- VictoriaMetrics VictoriaMetrics
From 1.137.0 · fixed in 1.146.0; From 1.123.0 · fixed in 1.136.12; fixed in 1.122.25
- github.com/VictoriaMetrics/VictoriaMetricsGo
fixed in 1.122.25; From 1.123.0 · fixed in 1.136.12; From 1.137.0 · fixed in 1.146.0
- github.com/VictoriaMetrics/VictoriaMetricsGo
From 1.137.0 · fixed in 1.146.0
- github.com/VictoriaMetrics/VictoriaMetricsGo
From 1.123.0 · fixed in 1.136.12
- github.com/VictoriaMetrics/VictoriaMetricsGo
fixed in 1.122.25