Werk #10462: WATO backups: Fix file path traversal vulnerability

Component	Setup
Title	WATO backups: Fix file path traversal vulnerability
Date	Nov 22, 2019
Level	Trivial Change
Class	Security Fix
Compatibility	Compatible - no manual interaction needed
Checkmk versions & editions	2.0.0i1 Checkmk Community, Checkmk Pro, Checkmk Ultimate MT 1.6.0p7 Checkmk Community, Checkmk Pro, Checkmk Ultimate MT 1.5.0p24 Checkmk Community, Checkmk Pro, Checkmk Ultimate MT

The backup target directory was not validated correctly which made it possible for an attacker that has access to WATO backups to compromise the site.

Using this vulnerability it was possible to write backup files to directories that are writable by the site user.

Thanks to Robin ypid Schneider.

To the list of all Werks