CyberRota Analysis
AI-GeneratedKopia versions prior to 0.23.0 are vulnerable to unauthenticated access to its HTTP server, allowing attackers to exploit the SFTP storage configuration and potentially execute arbitrary commands via SSH. This critical vulnerability affects both Windows and Linux platforms, posing a significant risk to systems using Kopia for backup operations. Organizations utilizing Kopia should prioritize upgrading to version 0.23.0 to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.