S3-Refresh path escape issue
Affected packages
proxmox-backup-server
Details
Incomplete validation of an S3 object key returned by a configured S3 endpoint allowed an attacker with control over the S3 server to overwrite arbitrary host paths as user/group backup when an S3-refresh is triggered.
This issue was reported privately by Project Loupe.
Fixed in
- proxmox-backup-server >= 4.2.7-1
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.