CVE-2014-3225

What it actually does

Absolute path traversal in the web interface allows remote authenticated users to read arbitrary files on the server by supplying crafted paths in the Kickstart field of a profile.

Why it matters to the business

Attackers with valid credentials can access sensitive configuration files, credentials, or other data stored on the system, leading to potential data exposure and follow-on compromise across Debian-based backup-manager deployments.

How an attack unfolds

An attacker authenticates to the web interface, creates or modifies a profile, and inserts a malicious absolute path using directory traversal sequences into the Kickstart field; the server then returns the contents of the targeted file when the profile is processed.

How to fix it

Upgrade backup-manager on Debian 11, 12, and 13 to version 0.7.6-3 or later. Restrict web interface access to trusted networks and enforce least-privilege accounts until patches are applied.

How to confirm the fix worked

Confirm the installed package version meets or exceeds 0.7.6-3 on each affected Debian release; review web interface configuration to ensure the Kickstart field input is sanitized or removed.

Typical attack path

1. Obtain valid credentials for the web interface
2. Access the profile management section
3. Set the Kickstart field to an absolute path containing traversal sequences targeting a desired file
4. Trigger profile processing or viewing to retrieve file contents
5. Repeat to exfiltrate additional files or map the filesystem

How to detect it

Review web server and application logs for profile creation or modification events containing unusual absolute paths or traversal sequences in the Kickstart parameter; inspect system access logs for the web service user reading unexpected files.

• Kickstart field containing absolute paths or .. sequences
• Web service account accessing files outside expected directories

What your security team should do

• Immediately upgrade all instances to the fixed package versions provided for each Debian release
• Audit existing profiles for suspicious Kickstart field values
• Limit web interface exposure and require strong authentication controls
• Monitor for unusual file access patterns from the web service account