Werk #10462: WATO backups: Fix file path traversal vulnerability
| Component | WATO |
|---|---|
| Title | WATO backups: Fix file path traversal vulnerability |
| Date | 2019-11-22 15:00:39 |
| Checkmk Edition | Checkmk Raw Edition (CRE) |
| Checkmk Version | 1.6.0p7,2.0.0i1,1.5.0p24 |
| Level | Trivial Change |
| Class | Security Fix |
| Compatibility | Compatible - no manual interaction needed |
The backup target directory was not validated correctly which made it possible for an attacker that has access to WATO backups to compromise the site.
Using this vulnerability it was possible to write backup files to directories that are writable by the site user.
Thanks to Robin `ypid` Schneider.