Nixpkgs security tracker
4.1 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Required (R)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse ignored package cryptomator-cli
- @LeSuisse accepted
- @LeSuisse published on GitHub
Cryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths
Cryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its integrity is verified, and the masterkeyfile loader uses the unverified keyId as a filesystem path. The loader resolves keyId.getSchemeSpecificPart() directly against the vault path and immediately calls Files.exists(...). This allows a malicious vault config to supply parent-directory escapes, absolute local paths, or UNC paths (e.g., masterkeyfile://attacker/share/masterkey.cryptomator). On Windows, the UNC variant is especially dangerous because Path.resolve("//attacker/share/...") becomes \\attacker\share\..., so the existence check can trigger outbound SMB access before the user even enters a passphrase. This issue has been patched in version 1.19.1.
References
-
https://github.com/cryptomator/cryptomator/pull/4180 x_refsource_MISC
-
https://github.com/cryptomator/cryptomator/releases/tag/1.19.1 x_refsource_MISC
Affected products
- ==>= 1.6.0, <= 1.19.0
Matching in nixpkgs
pkgs.cryptomator
Free client-side encryption for your cloud files
Ignored packages (1)
pkgs.cryptomator-cli
Command line program to access encrypted Cryptomator vaults
Package maintainers
-
@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
-
@bachp Pascal Bach <pascal.bach@nextrem.ch>