Missing privilege check in sync-job modification allows denial of service
Affected packages
proxmox-backup-server
Details
A missing check for the current owner allowed a different user to take over a sync-job by pointing source and target to datastores or namespaces they have access to, effectively removing the sync-job for the original owner.
The effect is limited to a denial of service, no access to or exfiltration of data that the attacker is not allowed to access is possible.
An attacker would also need to guess or know the job id for modification, which is random by default.
The issue was privately reported by Yuliang Xiao <[email protected]>.
Fixed in
- proxmox-backup-server >= 4.2.9-1
This page reproduces the official Proxmox forum post (opens in a new tab). The original is authoritative.