Medium, CVSS 5.7PyPIAmendedPublished
B2 Command Line Tool TOCTOU application key disclosure
CVE-2022-23653 · GHSA-8wr4-2wm6-w3pr
- Affected
- PyPI b2 < 3.2.1
- Fixed in
- 3.2.1· Vendor fix available
- Issue
- Impact Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database file ($XDGCONFIGHOME/b2/accountinfo, ~/.b2accountinfo or a user-defined path) when b2 authorize-account is first run. This happens regardless of whether a valid key is provided or not. When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory is readable by a local attacker and the user did not yet run b2 authorize-account then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information…
Recommended action: Upgrade to 3.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.