Re: Path Traversal Vulnerability in pg_dump Directory Format

Hello!

>> > I was taking a look into the patch and, yes it works as expected, but I
>> > also manage to get the same result of a path traversal having a with a
>> > symlink as follow:
>> >
>> > blob_16388.dat -> ../../../../../../../etc/passwd
>> >
>> > Probably it could be worthy to add the symlink check with lstat() ?
>
> Yeah that makes sense. I have fixed that.

I've tested the patch and now the error it's clear:

pg_restore -f testo-bad3.sql testo.dump-traversal/
pg_restore: error: invalid archive: entry file "testo.dump-traversal//blob_123.dat" is a symbolic link

The only thing that it was a bit weird to me, is that the check using
lstat() was made after checking the traversal path, since this check is
less expensive in terms of functions calls, probably it could be
worthy?

Regards!
--
Jonathan Gonzalez V.
EDB
https://www.enterprisedb.com