CVE-2017-15914
📋 TL;DR
CVE-2017-15914 is an access control bypass vulnerability in Borg backup servers that allows remote users to override repository restrictions. This affects Borg servers version 1.1.x before 1.1.3, potentially allowing unauthorized access to restricted backup repositories.
💻 Affected Systems
- BorgBackup
📦 What is this software?
Borg by Borgbackup
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers gain unauthorized access to sensitive backup data, potentially leading to data theft, data destruction, or ransomware deployment on backup repositories.
Likely Case
Unauthorized users access backup repositories they shouldn't have permission to view or modify, potentially exposing sensitive data or compromising backup integrity.
If Mitigated
With proper network segmentation and authentication controls, impact is limited to authorized users within the same network segment.
🎯 Exploit Status
The vulnerability is in access control logic, making exploitation straightforward once identified. No authentication required for remote exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.3
Vendor Advisory: http://borgbackup.readthedocs.io/en/stable/changes.html#version-1-1-3-2017-11-27
Restart Required: Yes
Instructions:
1. Stop all Borg server processes. 2. Update Borg using your package manager: 'pip install --upgrade borgbackup' or use system package manager. 3. Restart Borg server processes.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to Borg servers using firewall rules
iptables -A INPUT -p tcp --dport 22 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
Disable Remote Access
allConfigure Borg to only accept local connections
borg serve --restrict-to-path /backup --restrict-to-repository /backup/repo
🧯 If You Can't Patch
- Implement strict network access controls to limit Borg server exposure
- Use SSH tunneling or VPN for all Borg server connections instead of direct network access
🔍 How to Verify
Check if Vulnerable:
Check Borg version: 'borg --version' should show version earlier than 1.1.3Check Version:
borg --versionVerify Fix Applied:
After update, verify version is 1.1.3 or later: 'borg --version'📡 Detection & Monitoring
Log Indicators:
- Unauthorized repository access attempts
- Failed access control checks in Borg server logs
Network Indicators:
- Unexpected Borg protocol traffic from unauthorized sources
- Multiple repository enumeration attempts
SIEM Query:
source="borg" AND (event="access_denied" OR event="unauthorized_access")