GHSA-j2g6-362q-6qc6: Path Traversal
Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 -> file created at /tmp/escape1 ../../../../../../../../tmp/escape2 -> file created at /tmp/escape2 ../../../tmp/cronpoc -> would be /etc/cron.d/backdoor in real attack ../../../tmp/sshpoc -> would be ~/.ssh/authorizedkeys ../../../tmp/kubeconfigpoc -> would be ~/.kube/config
It's possible that extracting files from the tarball during restore can overwrite sensitive files in the Velero pod filesystem.
Patches Has the problem been patched? What versions should users upgrade to?
By far, there is no patch yet. We are working on the main branch, then cherry-pick to the release-1.18 for v1.18.1 patch.
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?
There is no workaround, but the good news is that keeping your OSS safe will prevent the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/vmware-tanzu/veleroto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must compromise the backup object storage backend and upload a malicious backup tarball. Exploitation occurs when that tarball is extracted during a restore.
What can be affected after a malicious backup is restored?
Path-traversal filenames in the tarball can cause files outside the intended extraction directory to be overwritten in the Velero pod filesystem. Sensitive targets may include cron configuration, SSH authorized keys, kubeconfig files, or other writable paths.
What should teams do if they cannot patch immediately?
No workaround is provided. Protecting the backup object storage backend from compromise is the stated mitigation until a patch is available; work is planned for a v1.18.1 patch, but no patch exists yet.