FreedomBox Improper Permissions Vulnerability in Backups-Data Directory Allowing Database Dump Access

A vulnerability exists in FreedomBox versions prior to 25.17.1, where the backups-data directory does not have the correct permissions. This misconfiguration allows unauthorized reading of database dump files, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to database dump files, which may contain sensitive information.

Reproduction

On a fresh installation of FreedomBox without the patch, the backups-data directory is created with incorrect permissions, allowing unauthorized access to database dump files. After applying the patch, the directory is created with the correct permissions, restricting access to root users only.

Remediation

Users can update to FreedomBox version 25.17.1 or later, where this vulnerability has been addressed.