From 29ca3c093205395bdeb9dd98677ab4139c458aec Mon Sep 17 00:00:00 2001 From: Axel Burri Date: Sun, 19 Jul 2026 16:16:39 +0200 Subject: [PATCH] ssh_filter_btrbk.sh: fix regex end-of-string anchor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix SSH command filter bypass in ssh_filter_btrbk.sh (CVE-2026-62943). The regex allowlist pattern in ssh_filter_btrbk.sh lacked a proper end-of-string anchor, allowing attackers to append arbitrary commands after a valid btrbk command prefix using pipe characters. Thanks to @machin0r for responsible disclosure.  Bug introduced in commit: 8d0d7edda7cc775b87fd450266b756885f1eaa80 --- ssh_filter_btrbk.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ssh_filter_btrbk.sh b/ssh_filter_btrbk.sh index 0817563..d8adcb0 100755 --- a/ssh_filter_btrbk.sh +++ b/ssh_filter_btrbk.sh @@ -96,12 +96,12 @@ reject_filtered_cmd() # allow multiple paths (e.g. "btrfs subvolume snapshot ") allow_cmd_match="(${allow_list})( ${option_match})*( ${path_match})+" stream_in_match="(${decompress_match} \| )?(${mbuffer_match} \| )?" - stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match}$)?" + stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match})?" # `grep`’s `-q`-option is not used as it may cause an exit status of `0` even # when an error occurred. - allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}" + allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}$" if printf '%s' "${SSH_ORIGINAL_COMMAND}" | grep -E "${allow_stream_match}" >/dev/null 2>/dev/null; then return 0 fi