PT-2022-16163 · Backblaze · B2 Command Line Tool

Ooolap · Published 2022-02-23 · Updated 2022-03-07 · CVE-2022-23653

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions B2 Command Line Tool versions 3.2.0 and below

Description The B2 Command Line Tool contains a key disclosure vulnerability that can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The tool saves API keys in a local database file ($XDG CONFIG HOME/b2/account info, ~/.b2 account info or a user-defined path) when b2 authorize-account is first run. The file is initially world readable and later altered to be private to the user, allowing a local attacker to read the contents during the brief period between file creation and permission modification.

Recommendations For users who have not yet run b2 authorize-account, upgrade to B2 Command-Line Tool v3.2.1 before running it. For users who have run b2 authorize-account and the designated path could be opened by another local user, upgrade to B2 Command-Line Tool v3.2.1 and remove the database and regenerate all application keys. If B2 Command-Line Tool cannot be upgraded to v3.2.1 due to a dependency conflict, use a binary release instead, install a new version within a virtualenv, or change the permissions to prevent local users from opening the database file.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2022-23653

GHSA-8WR4-2WM6-W3PR

PYSEC-2022-32

Affected Products

B2 Command Line Tool

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23653.json · Exploit
• https://github.com/Backblaze/B2_Command_Line_Tool/commit/c74029f9f75065e8f7e3c3ec8e0a23fb8204feeb · Patch
• https://osv.dev/vulnerability/CVE-2022-23653 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8wr4-2wm6-w3pr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23653 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-32 · Vendor Advisory
• https://github.com/Backblaze/B2_Command_Line_Tool/security/advisories/GHSA-8wr4-2wm6-w3pr · Note
• https://github.com/Backblaze/B2_Command_Line_Tool · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/b2/PYSEC-2022-32.yaml · Note
• https://t.me/cvenotify/27252 · Telegram Post
• https://t.me/cibsecurity/37972 · Telegram Post