Description
Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
safing portmaster
Default version status: unaffected
0 to < 2.2.5affected
pkg:github/safing/portmasterReferences
- https://github.com/safing/portmaster/issues/2292 ↗
- https://github.com/safing/portmaster/blob/v2.2.3/service/core/api.go#L145-L159 ↗
- https://github.com/safing/portmaster/commit/f943e1eaf98f45bc48490bf288e1d63c04929ae0 ↗
- https://github.com/safing/portmaster/releases/tag/v2.2.5 ↗
- https://www.vulncheck.com/advisories/safing-portmaster-before-2.2.5-unauthenticated-forced-downgrade-via-api-v1-updates-from-url ↗