GHSA-7697-vf3j-253j: Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key
Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/masterkey.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabaseto a version that resolves this vulnerability.Fixed in 1.21.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Portabase deployments running a version earlier than 1.21.2 are affected. The vulnerable component is the TUS upload webhook handler.
Does exploitation require an authenticated Portabase account or user interaction?
No. An attacker can exploit the issue without authentication or user interaction.
What could an attacker change if exploitation succeeds?
An attacker can overwrite arbitrary files under Portabase's private data directory. This includes /data/private/keys/master_key.bin, which stores the AES-256-GCM master key.
What version fixes the vulnerability?
Upgrade Portabase to version 1.21.2, which patches the path traversal in the TUS upload webhook handler.