CVE-2020-8289: 
Homebrew vulnerability analysis and mitigation

CVE-2020-8289 is a critical remote code execution vulnerability affecting Backblaze for Windows and Backblaze for macOS. The vulnerability was discovered on March 13, 2020, by Jason Geffner and was publicly disclosed on September 9, 2020. The vulnerability affected Backblaze backup software, which is an online backup tool that allows Windows and macOS users to back up their data to offsite data centers (GitHub).

The vulnerability exists in the Backblaze client's service process (bzserv), which runs with SYSTEM/root privileges. The issue stems from the bztransmit program's SSL certificate validation logic, which disables certificate verification (CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST set to 0) when URLs contain specific strings like '.backblaze.xyz/', '.backblazeb2.xyz/', 'api/clientversion.xml', or 'api/install_backblaze'. This allows attackers to impersonate Backblaze's servers using invalid SSL certificates and deliver malicious updates (GitHub).

The vulnerability allows an unprivileged anonymous remote attacker to achieve remote code execution (RCE) with SYSTEM privileges on Windows and root privileges on macOS systems running vulnerable versions of Backblaze. This level of access gives attackers complete control over the affected systems (GitHub).

Proof-of-concept exploits have been developed for both Windows and macOS platforms. The attack can be executed by spoofing DNS responses to redirect Backblaze's update checks to an attacker-controlled server. The only validation performed on the downloaded file is checking for a specific magic string, making the vulnerability relatively straightforward to exploit (GitHub).

The vulnerability was patched in Backblaze version 7.0.1.433 for Windows and version 7.1.0.434 for macOS. Users should ensure they are running these versions or later to protect against this vulnerability (Backblaze Blog).