ambiser
/
btrbk
mirror of https://github.com/digint/btrbk
9
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ssh_filter_btrbk.sh: fix regex end-of-string anchor 

Fix SSH command filter bypass in ssh_filter_btrbk.sh (CVE-2026-62943).

The regex allowlist pattern in ssh_filter_btrbk.sh lacked a proper
end-of-string anchor, allowing attackers to append arbitrary commands
after a valid btrbk command prefix using pipe characters.

Thanks to @machin0r for responsible disclosure.

Bug introduced in commit: 8d0d7edda7
master^2
Axel Burri 2026-07-19 16:16:39 +02:00
parent ebcc4bdd03
commit 29ca3c0932
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ssh_filter_btrbk.sh
View File

@ -96,12 +96,12 @@ reject_filtered_cmd()
# allow multiple paths (e.g. "btrfs subvolume snapshot <src> <dst>")
allow_cmd_match="(${allow_list})( ${option_match})*( ${path_match})+"
stream_in_match="(${decompress_match} \| )?(${mbuffer_match} \| )?"
stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match}$)?"
stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match})?"
# `grep`’s `-q`-option is not used as it may cause an exit status of `0` even
# when an error occurred.
allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}"
allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}$"
if printf '%s' "${SSH_ORIGINAL_COMMAND}" | grep -E "${allow_stream_match}" >/dev/null 2>/dev/null; then
return 0
fi