Missing protections against bogus snapshot creation

Details

An attacker that only has "Datastore.Backup" privileges on a datastore could create bogus snapshots in a group they own. Independently executed prune tasks (such as by a scheduled job or administrator with higher privileges) would treat such bogus snapshots as legitimate.

These two issues combined could be exploited to trigger a pruning of all legitimate snapshots in such an accessible group, thwarting the ransomware protection guards usually associated with only giving "Datastore.Backup" privileges to a user/token.

Creating such bogus snapshots is now restricted.

These issues were discovered internally, and independently reported by Richard DEMONGEOT - Rdem Systems <[email protected]>.

Fixed in

• proxmox-backup-server >= 4.2.9-1

References

• https://nimbus.rdem-systems.com/en/blog/pbs-weakness-found-reported/ (opens in a new tab)