Missing privilege check in sync-job modification allows denial of service
Betroffene Pakete
proxmox-backup-server
Details
A missing check for the current owner allowed a different user to take over a sync-job by pointing source and target to datastores or namespaces they have access to, effectively removing the sync-job for the original owner.
The effect is limited to a denial of service, no access to or exfiltration of data that the attacker is not allowed to access is possible.
An attacker would also need to guess or know the job id for modification, which is random by default.
The issue was privately reported by Yuliang Xiao <[email protected]>.
Behoben in
- proxmox-backup-server >= 4.2.9-1
Diese Seite gibt den Inhalt des offiziellen Beitrags im Proxmox-Forum (öffnet in neuem Tab) wieder. Maßgeblich ist das Original. Der Text des Advisories wird so auf Englisch angezeigt, wie Proxmox ihn veröffentlicht hat.