Description
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Backblaze | Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
geffner/CVE-2020-8289 ★ 11 · Sep 9, 2020
CVE-2020-8289 – Remote Code Execution as SYSTEM/root via Backblaze
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://hackerone.com/reports/818853
- https://youtu.be/W0THXbcX5V8
- https://github.com/geffner/CVE-2020-8289/blob/master/README.md
- https://www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1/
- 20201229 Re: [FD] CVE-2020-8150 - Remote Code Execution as SYSTEM/root via Backblaze mailing-list
- 20201229 Re: CVE-2020-8150 - Remote Code Execution as SYSTEM/root via Backblaze mailing-list