integrity bypass of encrypted backups on an untrusted PBS instance

Details

When a PBS client is configured with an encryption/signing key, it silently accepted a backup manifest that carried no signature. An attacker with write access to the PBS server could replace a signed manifest with an unsigned one, defeating the integrity guarantee that client-side encryption and signatures are meant to provide when interacting with an untrusted server/storage.

This is an integrity-only issue: the attacker never learns the encryption key or original plaintext, so confidentiality of the encrypted backup itself is not affected.

Whenever a client is configured with an encryption/signing key, it will now only trust signed manifests, unless explicitly overridden using a newly introduced flag.

Note: The Proxmox VE storage integration currently does not provide an override to allow accessing unsigned backups if a PBS storage is configured with an encryption key. To access plain text backups made before setting up encryption, or synced without encryption from another source on the PBS side, move or sync such backups to a different namespace and configure that namespace as additional PBS storage.

This issue was reported privately by Shaun Mirani, and later independently by Project Loupe.

Fixed in

• proxmox-backup-client(-static), proxmox-backup-file-restore >= 4.2.6-1

• libproxmox-backup-qemu0 >= 2.0.3