Headline

CVE-2022-45866: Fix qpress directory traversal vulnerability (#6) · EvgeniyPatlan/qpress@ddb3120

qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via …/ in a .qp file.

2 years ago

CVE

Open in Source

#vulnerability #web #amazon #aws #auth

Permalink

Browse files

Fix qpress directory traversal vulnerability (PierreLvx#6)

A bad actor user can prepare the payload as:

``` mkdir -p AAAAAAAAA/secure_file_priv_dir touch AAAAAAAAA/secure_file_priv_dir/evil.so qpress -r AAAAAAAAA payload.qp Then edit the payload.qp in a hex editor or sed to replace AAAAAAAAA with …/…/…/ (example: sed -i ‘s/AAAAAAAAA/…\/…\/…\//’ payload.qp) ```

Fix bug by checking the directory and reject the command if find the attempt to traversal

Test: see example above and try to reproduce it. Before fix you can observe traversal. After fix - the error message(File path contains directory traversal which is not allowed.) shown, no traversal observe.

All new code of the whole pull request, including one or several files that are either new files or modified ones, are contributed under the BSD-new license. I am contributing on behalf of my employer Amazon Web Services, Inc.

Co-authored-by: Mikhail Chalov [email protected]