CVE-2022-23651: b2-sdk-python TOCTOU application key disclosure
Summary
CVE-2022-23651: b2-sdk-python TOCTOU application key disclosure. Affects b2sdk versions < 1.14.1. Fixed in 1.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The b2-sdk-python package is a software development kit (SDK) for interacting with the Backblaze B2 Cloud Storage service. It provides a set of tools and APIs for developers to integrate B2 Cloud Storage into their applications. The SDK allows users to manage files, buckets, and other resources in the B2 Cloud Storage service. However, versions 1.14.0 and below of the SDK for Linux and Mac contain a key disclosure vulnerability that can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition.
Vulnerability Detail
The vulnerability affects users of the SqliteAccountInfo format in the b2-sdk-python SDK. This format saves API keys and bucket name-to-id mapping in a local database file. When the file is first created, it is world-readable and is later modified to be private to the user. However, during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the attacker to read the contents of the file, including sensitive information such as API keys, after it has been saved. This vulnerability can be exploited by a local attacker who has access to the directory containing the database file. Users of the InMemoryAccountInfo format are not affected by this vulnerability.
How To Fix
Minimum fixed version
1.14.1
This is the first release that contains the fix.
pip install --upgrade "b2sdk==1.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If users believe that a local attacker might have opened a handle to the vulnerable database file using the race condition, it is recommended to remove the affected database files and regenerate all application keys. This can be done by deleting the database file ($XDG_CONFIG_HOME/b2/account_info, ~/.b2_account_info, or the user-defined path) and following the necessary steps to generate new application keys.
Conclusion
The b2-sdk-python package versions 1.14.0 and below for Linux and Mac are vulnerable to a key disclosure vulnerability. Users of the SqliteAccountInfo format are affected, while users of the InMemoryAccountInfo format are not. To fix the vulnerability, users should upgrade to version 1.14.1 or later of the b2-sdk-python SDK. If a local attacker might have exploited the vulnerability, it is recommended to remove the affected database files and regenerate all application keys. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for b2sdk →
FAQ
Versions 1.14.0 and below of the b2-sdk-python SDK for Linux and Mac are affected by this vulnerability.
No, users of the InMemoryAccountInfo format are not affected by this vulnerability. Only users of the SqliteAccountInfo format are vulnerable.
The vulnerability allows a local attacker to read sensitive information, such as API keys, from the database file used by the b2-sdk-python SDK. This can potentially lead to unauthorized access to the Backblaze B2 Cloud Storage service and the data stored within it.
To fix the vulnerability, users should upgrade to version 1.14.1 or later of the b2-sdk-python SDK. This version includes a patch that addresses the key disclosure issue.
If you suspect a local attacker has exploited this vulnerability, it is recommended to remove the affected database files and regenerate all application keys. This can be done by deleting the database file and following the necessary steps to generate new application keys.
