CVE-2022-23653: B2 Command Line Tool TOCTOU Application Key Disclosure
Summary
CVE-2022-23653: B2 Command Line Tool TOCTOU application key disclosure. Affects b2 versions < 3.2.1. Fixed in 3.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The B2 command-line tool is a software package used for interacting with the B2 Cloud Storage service. It provides a command-line interface for managing files, buckets, and other resources in the B2 cloud. The tool allows users to authorize their B2 account, upload and download files, and perform various administrative tasks. However, versions 3.2.0 and below of the B2 command-line tool for Linux and Mac contain a key disclosure vulnerability that can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition.
Vulnerability Detail
The vulnerability in the B2 command-line tool arises from the way it saves API keys and bucket name-to-id mapping in a local database file. When the b2 authorize-account command is first run, the tool creates this file ($XDG_CONFIG_HOME/b2/account_info, ~/.b2_account_info, or a user-defined path) and saves the sensitive information to it. However, during a brief period between file creation and permission modification, the file is world-readable. If a local attacker has read access to the directory and can race to open the file before the permissions are changed, they can obtain the API keys and other sensitive data. This vulnerability is classified as a time-of-check-time-of-use (TOCTOU) race condition.
How To Fix
Minimum fixed version
3.2.1
This is the first release that contains the fix.
pip install --upgrade "b2==3.2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to B2 Command-Line Tool v3.2.1 is not possible due to dependency conflicts, a binary release can be used as an alternative. Another option is to install a new version within a virtual environment (virtualenv). Alternatively, the permissions of the database file can be changed to prevent local users from opening it.
Conclusion
The B2 Command Line Tool version 3.2.0 and below for Linux and Mac contains a key disclosure vulnerability that can be exploited by local attackers. Users are advised to upgrade to B2 Command-Line Tool v3.2.1 and follow the recommended steps to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for b2 →
FAQ
The B2 command-line tool is a software package used for interacting with the B2 Cloud Storage service. It provides a command-line interface for managing files, buckets, and other resources in the B2 cloud.
The key disclosure vulnerability in the B2 command-line tool can be exploited by local attackers to obtain API keys and other sensitive information. This can lead to unauthorized access to the B2 Cloud Storage service and potential data breaches.
Users should upgrade to B2 Command-Line Tool v3.2.1 if they have not yet run the b2 authorize-account command. If the command has already been run, it is recommended to upgrade to v3.2.1, remove the existing database file, and regenerate all application keys.
If upgrading to v3.2.1 is not possible, users can use a binary release or install a new version within a virtual environment. Another option is to change the permissions of the database file to prevent local users from accessing it.
No, running b2 clear-account does not remove the database file. It is recommended to manually remove the file and regenerate all application keys to ensure security.
