Werk #10462: WATO backups: Fix file path traversal vulnerability

Component Setup
Title WATO backups: Fix file path traversal vulnerability
Date Nov 22, 2019
Checkmk Edition Checkmk Raw (CRE)
Checkmk Version 1.5.0p24 1.6.0p7 2.0.0i1
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed

The backup target directory was not validated correctly which made it possible for an attacker that has access to WATO backups to compromise the site.

Using this vulnerability it was possible to write backup files to directories that are writable by the site user.

Thanks to Robin ypid Schneider.

To the list of all Werks