Summary
A path traversal vulnerability in Incus allows clients who can create instances to write controlled content to unintended locations on the host during crafted instance backup import. Successful exploitation may create root-owned directories and could lead to host compromise when dependent custom volume names are not safely validated.
A path traversal vulnerability in Incus allows clients who can create instances to write controlled content to unintended locations on the host during crafted instance backup import. Successful exploitation may create root-owned directories and could lead to host compromise when dependent custom volume names are not safely validated.
Affected context
The issue occurs in Incus environments where a client with instance-creation privileges can import instance backups containing dependent custom volumes. Risk is present when backup metadata is trusted during restoration and volume names are not constrained to an approved, host-local naming format before filesystem paths are constructed.
The issue occurs in Incus environments where a client with instance-creation privileges can import instance backups containing dependent custom volumes. Risk is present when backup metadata is trusted during restoration and volume names are not constrained to an approved, host-local naming format before filesystem paths are constructed.
Exploit preconditions
- Attack surface: Incus instance backup import and restoration handling
- Required access: Client permissions sufficient to create instances or import instance backups
- Trigger point: Processing dependent custom volume names from an instance backup index
- Why exploitation is possible: Unvalidated names can influence host filesystem paths and cause content to be written outside the intended volume location
- Attack surface: Incus instance backup import and restoration handling
- Required access: Client permissions sufficient to create instances or import instance backups
- Trigger point: Processing dependent custom volume names from an instance backup index
- Why exploitation is possible: Unvalidated names can influence host filesystem paths and cause content to be written outside the intended volume location
Why this happens
The underlying bug is improper validation of user-controlled path components, mapping to CWE-22: Path Traversal. The backup restoration logic accepts dependent custom volume names without sufficiently restricting path semantics, allowing metadata to influence filesystem locations beyond the designated storage directory. The insecure pattern is treating externally supplied identifiers as safe path components rather than canonicalizing them and enforcing containment within an approved directory.
The underlying bug is improper validation of user-controlled path components, mapping to CWE-22: Path Traversal. The backup restoration logic accepts dependent custom volume names without sufficiently restricting path semantics, allowing metadata to influence filesystem locations beyond the designated storage directory. The insecure pattern is treating externally supplied identifiers as safe path components rather than canonicalizing them and enforcing containment within an approved directory.
Potential impact
- Creation of attacker-controlled directories or files on the host
- Modification of sensitive host filesystem locations
- Execution or activation of malicious content by host services
- Bypass of ownership and storage-boundary assumptions
- Full compromise of the Incus host
- Lateral movement to other workloads or infrastructure
- Creation of attacker-controlled directories or files on the host
- Modification of sensitive host filesystem locations
- Execution or activation of malicious content by host services
- Bypass of ownership and storage-boundary assumptions
- Full compromise of the Incus host
- Lateral movement to other workloads or infrastructure
General mitigation guidance
Mitigation generally focuses on enforcing strict storage-boundary controls throughout backup import and restoration workflows.
Common defensive patterns include:
- Treating backup metadata and volume names as untrusted input
- Allowing only validated identifiers that match a narrow, canonical naming policy
- Canonicalizing candidate paths and verifying that they remain within the intended storage root
- Rejecting absolute paths, traversal components, separators, and other ambiguous path forms
- Using secure filesystem APIs that enforce directory containment where available
- Applying least-privilege service accounts and limiting host filesystem access
- Separating backup extraction from sensitive host paths and using isolated temporary storage
- Preserving safe ownership and permission defaults during restoration
Mitigation generally focuses on enforcing strict storage-boundary controls throughout backup import and restoration workflows.
Common defensive patterns include:
- Treating backup metadata and volume names as untrusted input
- Allowing only validated identifiers that match a narrow, canonical naming policy
- Canonicalizing candidate paths and verifying that they remain within the intended storage root
- Rejecting absolute paths, traversal components, separators, and other ambiguous path forms
- Using secure filesystem APIs that enforce directory containment where available
- Applying least-privilege service accounts and limiting host filesystem access
- Separating backup extraction from sensitive host paths and using isolated temporary storage
- Preserving safe ownership and permission defaults during restoration
How teams detect issues like this
Detection can combine code analysis, runtime monitoring, and policy enforcement:
- Static analysis for filesystem operations that concatenate user-controlled names into paths
- Code review checks for missing canonicalization and storage-root containment validation
- Tests using malformed, absolute, encoded, and platform-specific path representations
- Monitoring for unexpected directory creation or file writes outside approved Incus storage locations
- Audit rules for backup imports performed by clients with elevated instance-management privileges
- Policy checks requiring validated identifiers and least-privilege filesystem permissions
- Automated security review tools that flag path construction from archive or backup metadata
Detection can combine code analysis, runtime monitoring, and policy enforcement:
- Static analysis for filesystem operations that concatenate user-controlled names into paths
- Code review checks for missing canonicalization and storage-root containment validation
- Tests using malformed, absolute, encoded, and platform-specific path representations
- Monitoring for unexpected directory creation or file writes outside approved Incus storage locations
- Audit rules for backup imports performed by clients with elevated instance-management privileges
- Policy checks requiring validated identifiers and least-privilege filesystem permissions
- Automated security review tools that flag path construction from archive or backup metadata
