Cloudanix VulnDB

CVE-2018-1217

Critical · 9.8

CVSS

9.8

EPSS

50.9%

Published

Apr 9, 2018

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Attend

Old backup software lets outsiders grab or change secret login details used to reach vendor support without needing any password.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing access control check in Avamar Installation Manager permits remote unauthenticated reads or modifications of LDLS credentials used for Dell EMC Online Support connections, enabling impersonation of service actions.

Why it matters to the business

Attackers can steal or alter credentials needed for support connectivity, risking service disruption, unauthorized impersonation of backup operations, and exposure of sensitive support account data on long-unpatched legacy systems.

How an attack unfolds

An attacker discovers an exposed Avamar Installation Manager instance and issues direct unauthenticated HTTP requests to the LDLS configuration endpoints, extracting or overwriting the stored credentials before using them to authenticate to Dell EMC Online Support as the AVI service.

How to fix it

Upgrade Dell EMC Avamar Server beyond 7.5.0 and Integrated Data Protection Appliance beyond 2.1 to versions containing the access control fix; restrict network access to Installation Manager to trusted management hosts only.

How to confirm the fix worked

Confirm that LDLS credential endpoints now enforce authentication, review product release notes for the specific patch that added the missing access control, and perform authenticated vs. unauthenticated request tests from a non-privileged source.

Typical attack path

  1. Scan for publicly reachable Avamar Installation Manager instances on affected versions
  2. Send crafted unauthenticated requests targeting LDLS credential endpoints
  3. Read or modify the stored LDLS credentials
  4. Reuse the obtained credentials to log in to Dell EMC Online Support and impersonate service actions

How to detect it

Search Avamar Installation Manager and LDLS logs for unauthenticated requests, unexpected credential read or update events, and any outbound connections to Dell EMC Online Support originating from non-standard service accounts.

  • LDLS credential read without authentication
  • LDLS credential modification via unauthenticated request
  • Avamar Installation Manager access to /ldls or equivalent endpoints lacking auth tokens

What your security team should do

  • Prioritize immediate network segmentation of affected Avamar and IDPA management interfaces given weaponized exploit maturity and high EPSS
  • Audit logs for any historical unauthenticated LDLS access since 2018-04-09
  • Replace any potentially compromised LDLS credentials and rotate associated Dell EMC Online Support accounts

The record

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities