Cloudanix VulnDB

CVE-2017-12478

Critical · 9.8

CVSS

9.8

EPSS

78.3%

Published

Aug 7, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A flaw in older backup software lets attackers on the internet take over the system completely without needing any password, putting critical recovery data at risk.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Authentication Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Unauthenticated remote command execution with root privileges due to missing input validation on an API parameter in the storage web interface.

Why it matters to the business

Attackers can gain full control of backup systems, leading to data theft, ransomware deployment, or destruction of backups that organizations rely on for recovery.

How an attack unfolds

An attacker sends a crafted request to the unauthenticated api/storage endpoint with a malicious parameter value; the lack of validation allows the payload to execute arbitrary operating system commands as root. Publicly weaponized exploits have been available since shortly after disclosure in 2017.

How to fix it

Upgrade all Unitrends Backup installations to version 10.0.0 or later. If immediate upgrade is impossible, restrict network access to the web interface to trusted management hosts only.

How to confirm the fix worked

Verify the installed version is 10.0.0 or newer; attempt an unauthenticated request to the api/storage endpoint and confirm it now returns an authentication error rather than executing commands.

Typical attack path

  1. Discover exposed Unitrends Backup web interface via network scanning
  2. Craft HTTP request targeting api/storage with unsanitized parameter
  3. Submit request to trigger command execution without authentication
  4. Escalate to root-level shell or install persistent backdoor

How to detect it

Review web server access logs for requests to api/storage that lack session cookies or authentication headers and contain unusual parameter values; check process execution logs for unexpected root-level commands originating from the backup service user.

  • POST /api/storage
  • unitrends
  • root shell spawned from web process

What your security team should do

  • Immediately upgrade affected appliances to 10.0.0 or later given the high EPSS score and weaponized exploit maturity
  • Place the management interface behind a VPN or strict firewall rules
  • Audit backup integrity and retention policies in case prior compromise occurred
  • Monitor for any post-exploitation artifacts on systems that were reachable from the internet

The record

It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities