Summary
A path traversal vulnerability in pghoard restore processing allows crafted backup metadata to escape the intended PostgreSQL data directory. An attacker who can write to the configured backup object storage may cause arbitrary files or directories to be created when an administrator performs a restore, potentially enabling host compromise.
A path traversal vulnerability in pghoard restore processing allows crafted backup metadata to escape the intended PostgreSQL data directory. An attacker who can write to the configured backup object storage may cause arbitrary files or directories to be created when an administrator performs a restore, potentially enabling host compromise.
Affected context
The issue occurs in pghoard deployments that restore PostgreSQL backups from attacker-influenced object storage, including S3, GCS, or Azure-compatible services. It becomes risky when backup manifests are processed without fully canonicalizing and restricting paths to the designated PostgreSQL data directory, allowing restore operations to affect other locations on the host.
The issue occurs in pghoard deployments that restore PostgreSQL backups from attacker-influenced object storage, including S3, GCS, or Azure-compatible services. It becomes risky when backup manifests are processed without fully canonicalizing and restricting paths to the designated PostgreSQL data directory, allowing restore operations to affect other locations on the host.
Exploit preconditions
- Attack surface: pghoard backup object storage and restore processing
- Required access: Write access to the object storage location used for backup data
- Trigger point: A database administrator or automated process performs a base-backup restore
- Why exploitation is possible: Restore paths derived from malicious backup metadata may contain traversal components that resolve outside the permitted PostgreSQL data directory
- Attack surface: pghoard backup object storage and restore processing
- Required access: Write access to the object storage location used for backup data
- Trigger point: A database administrator or automated process performs a base-backup restore
- Why exploitation is possible: Restore paths derived from malicious backup metadata may contain traversal components that resolve outside the permitted PostgreSQL data directory
Why this happens
The underlying bug is incomplete path validation during archive or backup restoration. Path components supplied through backup manifests are trusted without consistently resolving the final path and verifying that it remains beneath the configured pgdata directory.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The insecure pattern allows attacker-controlled relative paths to influence filesystem writes outside the intended storage boundary.
The underlying bug is incomplete path validation during archive or backup restoration. Path components supplied through backup manifests are trusted without consistently resolving the final path and verifying that it remains beneath the configured pgdata directory.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The insecure pattern allows attacker-controlled relative paths to influence filesystem writes outside the intended storage boundary.
Potential impact
- Arbitrary files may be written on the host running the restore operation
- Unexpected directories may be created outside the PostgreSQL data directory
- Persistence mechanisms or configuration files could be modified
- The PostgreSQL service or restore environment could be compromised
- Host-level code execution may occur if a written file is later executed or loaded
- Backup integrity and database availability could be affected
- Arbitrary files may be written on the host running the restore operation
- Unexpected directories may be created outside the PostgreSQL data directory
- Persistence mechanisms or configuration files could be modified
- The PostgreSQL service or restore environment could be compromised
- Host-level code execution may occur if a written file is later executed or loaded
- Backup integrity and database availability could be affected
General mitigation guidance
Mitigation typically focuses on enforcing a strict filesystem boundary for every restore operation.
Common defensive patterns include:
- Canonicalizing and normalizing each restored path before file access
- Rejecting absolute paths, traversal components, and paths that resolve outside the approved directory
- Applying the same boundary checks to directory creation, temporary files, links, and renamed files
- Treating backup object storage as untrusted input and restricting write permissions
- Using isolated restore environments with least-privilege service accounts
- Separating restore credentials and storage namespaces from production backup writers
- Applying filesystem, container, and operating-system controls that limit the restore process to required locations
Mitigation typically focuses on enforcing a strict filesystem boundary for every restore operation.
Common defensive patterns include:
- Canonicalizing and normalizing each restored path before file access
- Rejecting absolute paths, traversal components, and paths that resolve outside the approved directory
- Applying the same boundary checks to directory creation, temporary files, links, and renamed files
- Treating backup object storage as untrusted input and restricting write permissions
- Using isolated restore environments with least-privilege service accounts
- Separating restore credentials and storage namespaces from production backup writers
- Applying filesystem, container, and operating-system controls that limit the restore process to required locations
How teams detect issues like this
Detection can combine source review, runtime monitoring, and storage policy controls:
- Use static analysis rules for filesystem operations that concatenate untrusted paths without canonicalization and containment checks.
- Review restore code for validation performed before writes, directory creation, renames, and symbolic-link handling.
- Monitor restore processes for writes outside the expected PostgreSQL data directory.
- Alert on unexpected changes to sensitive system directories and scheduled-task locations.
- Enforce object-storage policies that limit who can create or modify backup objects and record manifest changes.
- Use automated security review tools to identify traversal-prone path handling and missing boundary checks.
Detection can combine source review, runtime monitoring, and storage policy controls:
- Use static analysis rules for filesystem operations that concatenate untrusted paths without canonicalization and containment checks.
- Review restore code for validation performed before writes, directory creation, renames, and symbolic-link handling.
- Monitor restore processes for writes outside the expected PostgreSQL data directory.
- Alert on unexpected changes to sensitive system directories and scheduled-task locations.
- Enforce object-storage policies that limit who can create or modify backup objects and record manifest changes.
- Use automated security review tools to identify traversal-prone path handling and missing boundary checks.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
