Path Traversal in rdiffweb 7.1.1

Executive Summary

This is a path traversal vulnerability in ikus060 rdiffweb version 7.1.1 where an authenticated user can bypass path containment checks using percent-encoded traversal sequences like %2e%2e in request paths. The application uses string prefix comparison instead of proper filesystem boundary checks, allowing access to sibling paths that share the repository name prefix. This could let users operate on or delete unintended data outside their authorized repository.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual file access patterns or errors in rdiffweb logs when users browse, restore, or delete files. Look for percent-encoded traversal sequences (%2e%2e) in request paths. Verify if users can access files outside their intended repository directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could access or delete files outside their intended repository if the repository name matches a sibling path prefix. This could lead to unauthorized data exposure, data loss, or corruption of other users' backups. The impact requires the attacker to already have permissions on the target path and knowledge of the repository naming scheme.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to personal or health information stored in backup repositories. It undermines principles of least privilege and data integrity, potentially leading to compliance breaches if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update rdiffweb to the latest patched version that includes the _is_child_of() path validation method. Review and restrict user permissions to prevent unauthorized access to sibling paths. Monitor logs for suspicious activity involving path traversal attempts.

Useful 0 Not Useful 0