Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

Vulnerability

Overview

Magic Wormhole versions 0.21.0 through 0.22.x contain a path traversal vulnerability in the wormhole receive command. The root cause is the accidental removal of a basename() check on incoming filenames during a refactoring in version 0.21.0 [2]. Without this check, a malicious sender can provide a filename containing path components like ../../.bashrc, causing the receiver to write the file to an arbitrary location outside the intended directory.

Exploitation

An attacker must be the sender of a file transfer (i.e., run wormhole send) to exploit this vulnerability. Other parties, including transit and relay servers, are excluded by the wormhole protocol [1][2]. The attack requires no additional privileges on the receiver's system; the receiver simply accepts the transfer, and the malicious filename is used to determine the write destination. The attacker can craft filenames that target sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or other configuration files.

Impact

Successful exploitation allows overwriting critical local files, which can lead to full compromise of the receiver's computer. For example, overwriting authorized_keys could allow the attacker to install their SSH key and gain persistent remote access, while overwriting shell startup scripts could execute arbitrary commands on login [1][2].

Mitigation

This vulnerability is fixed in Magic Wormhole version 0.23.0, which restores the basename check and adds a unit test to prevent regression [2]. Users should upgrade immediately. As a workaround, the receiver can override the sender's filename using the --output or -o option to specify a safe local path on every invocation of wormhole receive [2].