PMG: Administrator to root privilege escalation via private keys in backup

Details

A user with Administrator role could create and download a backup, which includes the private key material for the API server. This can be used to forge a session as the root@pam user.

Since the host where a backup is being restored already has its own set of authentication keys, and any derived values are only valid temporarily, not including them in the backup both improves post-restore behaviour of the system, and prevents leaking of the keys used by the backed-up system.

The issue was privately reported by Điềm from VNPT-VCI.

Fixed in

• pmg-api >= 9.1.3