GHSA-vq4h-xrwc-m639

rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access

Source: GitHub Advisory Database (reviewed) High CVE-2022-3221

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rdiffweb	< 2.4.3	2.4.3

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb prior to 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). While adding SSH public keys to the profile, the server accepts the GET request, which results in adding an SSH public key to the profile and leads to unauthorized access to the system and backups. Version 2.4.3 contains a patch for this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3221 advisory
https://github.com/ikus060/rdiffweb/commit/9125f5a2d918fed0f3fc1c86fa94cd1779ed9f73 web
https://github.com/advisories/GHSA-vq4h-xrwc-m639 advisory
https://github.com/ikus060/rdiffweb package
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-278.yaml web
https://huntr.dev/bounties/1fa1aac9-b16a-4a70-a7da-960b3908ae1d web