Safing Portmaster Missing Authorization Update Bypass

Executive Summary

Safing Portmaster before version 2.2.5 has a missing authorization vulnerability. This flaw allows unprivileged local processes to force software updates by calling a specific API endpoint. Attackers can manipulate the update process by providing a malicious URL, bypassing version checks and auto-apply settings. This could lead to the installation of older versions of the software that contain previously fixed vulnerabilities.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if Safing Portmaster versions before 2.2.5 are installed. Inspect the installed version using commands like 'portmaster --version' or checking package managers (e.g., 'apt list --installed | grep portmaster' for Debian-based systems). Monitor network traffic for unauthorized POST requests to /api/v1/updates/from-url endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers with local access to your system to install outdated and potentially vulnerable versions of Safing Portmaster. This might reintroduce security flaws that were previously patched, increasing the risk of exploitation by malicious actors. It could compromise the integrity and security of your system's network monitoring and protection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Safing Portmaster to version 2.2.5 or later. Disable local process permissions to call the /api/v1/updates/from-url endpoint if possible. Restrict network access to the Portmaster API endpoints and audit logs for suspicious update requests.

Useful 0 Not Useful 0