CVE-2022-23651: Key Disclosure Vulnerability in b2-sdk-python
Summary
CVE-2022-23651: b2-sdk-python is a python library to access cloud storage provided by backblaze. Affects b2sdk across 2 version ranges.
< 1.14.1
< 62476638986e5b6d7459aca5ef8ce220760226e0
Fixed in 62476638986e5b6d7459aca5ef8ce220760226e0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
b2-sdk-python is a python library that provides access to cloud storage services offered by Backblaze. It allows users to interact with the storage system and perform various operations such as uploading, downloading, and managing files. The SDK version 1.14.0 and below for Linux and Mac platforms are affected by a key disclosure vulnerability. This vulnerability can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The vulnerability specifically affects users of the SqliteAccountInfo format, while users of the InMemoryAccountInfo format are not affected. SqliteAccountInfo saves API keys and bucket name-to-id mapping in a local database file. During the brief period between file creation and permission modification, if the directory containing the file is readable by a local attacker, they can race to open the file and gain access to the sensitive information. This vulnerability can lead to unauthorized access to the cloud storage account and potential data breaches.
Vulnerability Detail
The key disclosure vulnerability in b2-sdk-python arises due to a race condition in the handling of the SqliteAccountInfo format. When the account info file is created, it is initially world-readable and then quickly modified to be private. However, during this short window, a local attacker can open the file and maintain a handle to it, allowing them to read the sensitive information stored in the file. This can result in the disclosure of API keys and bucket name-to-id mapping, potentially leading to unauthorized access to the cloud storage account and data compromise. The vulnerability affects SDK versions 1.14.0 and below for Linux and Mac platforms.
How To Fix
Minimum fixed version
62476638986e5b6d7459aca5ef8ce220760226e0
This is the first release that contains the fix.
pip install --upgrade "b2sdk==62476638986e5b6d7459aca5ef8ce220760226e0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, users can ensure that the directory containing the account info file is not readable by unauthorized users. This can help mitigate the risk of a local attacker exploiting the race condition to gain access to the sensitive information.
Conclusion
The key disclosure vulnerability in b2-sdk-python can allow local attackers to gain unauthorized access to cloud storage accounts. Users of the affected SDK versions should upgrade to version 1.14.1 or later to mitigate this vulnerability. It is also recommended to ensure that the directory containing the account info file is not readable by unauthorized users. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for b2sdk →
FAQ
The vulnerability affects SDK versions 1.14.0 and below for Linux and Mac platforms.
No, users of the InMemoryAccountInfo format are not affected by this vulnerability. Only users of the SqliteAccountInfo format are vulnerable.
The key disclosure vulnerability in b2-sdk-python can lead to unauthorized access to the cloud storage account and potential data breaches. Attackers who exploit this vulnerability can obtain API keys and bucket name-to-id mapping, which can be used to perform unauthorized operations on the storage system.
To protect your installation, make sure to upgrade to b2-sdk-python version 1.14.1 or later. This version includes a fix for the key disclosure vulnerability. Additionally, ensure that the directory containing the account info file is not readable by unauthorized users.
There is no known exploit available for this vulnerability at the moment. However, it is important to apply the recommended fix to prevent any potential exploitation.
