CVE-2024-48248

What it actually does

NAKIVO Backup & Replication versions before 11.0.0.88174 contain an absolute path traversal flaw in the getImageByPath functionality exposed through /c/router. A remote attacker can manipulate file path input so the application reads files outside the intended image/resource directory. Because backup platforms commonly store infrastructure connection details, and this issue is reported to expose cleartext credentials associated with PhysicalDiscovery, successful exploitation can lead to credential theft, access to protected systems managed by the backup server, and potentially broader remote code execution or enterprise-wide compromise through reuse of stolen administrative credentials.

Why it matters to the business

This is a high-urgency backup-infrastructure vulnerability with active exploitation, KEV listing, and a very high EPSS score, meaning exposed systems are likely to be targeted. Compromise of a backup server can undermine recovery capability, expose privileged infrastructure credentials, enable lateral movement into virtual, physical, or cloud workloads, and increase the impact of extortion or destructive attacks even though CISA has not specifically marked this CVE as ransomware-used. Organizations subject to CISA KEV guidance were expected to remediate by 2025-04-09.

How an attack unfolds

An attacker first identifies an internet-facing or reachable NAKIVO Backup & Replication web interface running a vulnerable version. They then send crafted requests to the /c/router endpoint that invoke getImageByPath with an absolute or traversal-style file path instead of a legitimate image path. If vulnerable, the server returns arbitrary local file contents readable by the application process. The attacker prioritizes configuration and discovery files that may contain cleartext credentials, especially data associated with PhysicalDiscovery. Those credentials can then be used to authenticate to managed hosts, hypervisors, storage platforms, or other infrastructure connected to the backup system. From there, the attacker may pivot laterally, access backups, disable or delete recovery points, stage malware, or use privileged access to execute code across systems the backup platform manages.

How to fix it

Upgrade NAKIVO Backup & Replication to version 11.0.0.88174 or later. If immediate upgrade is not possible, restrict access to the NAKIVO web interface to trusted administrative networks or VPNs only, block public internet exposure, and apply vendor-recommended mitigations. Rotate credentials stored in or used by NAKIVO, especially credentials associated with PhysicalDiscovery and any managed infrastructure accounts, because successful exploitation may disclose them. Review and reduce privileges for backup service accounts, enforce network segmentation between the backup server and managed systems, and ensure backup repositories have immutability or deletion protection where available.

How to confirm the fix worked

Confirm the installed NAKIVO Backup & Replication version is 11.0.0.88174 or later through the product UI, package inventory, or host-level software inventory. Verify that /c/router is not reachable from untrusted networks and that only authorized administrative sources can access the management interface. Review change-management or vulnerability-scan results to ensure all NAKIVO servers, including standby or test instances, are upgraded. After patching, rotate relevant infrastructure credentials and validate that old credentials no longer work. Conduct a controlled, authorized verification that path traversal attempts against getImageByPath no longer return arbitrary local file contents.

Typical attack path

1. Discover a reachable NAKIVO Backup & Replication server and fingerprint the version or behavior.
2. Send crafted HTTP requests to /c/router targeting getImageByPath with path traversal or absolute path values.
3. Read sensitive local files from the backup server outside the intended resource directory.
4. Extract stored configuration data, secrets, or cleartext credentials related to PhysicalDiscovery or managed infrastructure.
5. Use recovered credentials to authenticate to connected systems such as hosts, hypervisors, storage, or backup repositories.
6. Expand access, tamper with backups, exfiltrate data, or execute commands using the privileges obtained from the backup environment.

How to detect it

Review HTTP access logs from NAKIVO, reverse proxies, load balancers, and WAFs for requests to /c/router that include getImageByPath and suspicious path values. Pay special attention to traversal encodings, absolute Windows or Linux paths, and requests for credential, configuration, password, shadow, SSH, or application database files. Correlate suspicious web requests with NAKIVO application logs, host file-access telemetry, EDR events, and authentication logs from infrastructure managed by the backup server. Look for reads or access attempts involving PhysicalDiscovery-related configuration data, followed by successful logins to hypervisors, hosts, storage, or backup repositories from unusual sources. Investigate any unexpected child processes, script execution, archive creation, outbound network connections, backup deletion, repository modification, or credential use after suspicious /c/router activity. Because exploitation is active in the wild, treat evidence of arbitrary file-read attempts as potential credential compromise even if no malware is found.

• /c/router
• getImageByPath
• PhysicalDiscovery
• ../
• ..%2f
• ..%252f
• %2e%2e%2f
• %252e%252e%252f
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• /root/.ssh/id_rsa
• C:\Windows\win.ini
• C:\Windows\System32\config\SAM
• C:\Windows\System32\config\SYSTEM
• C:\Users\Administrator\.ssh\id_rsa

What your security team should do

• Patch or upgrade all NAKIVO Backup & Replication servers to 11.0.0.88174 or later immediately due to active exploitation and KEV status.
• Remove internet exposure for NAKIVO management interfaces; allow access only from trusted administrative networks, jump hosts, or VPNs.
• Assume credentials stored in the backup platform may be compromised if the server was exposed before remediation; rotate NAKIVO, PhysicalDiscovery, hypervisor, host, storage, repository, and domain/service credentials as applicable.
• Hunt historical web, reverse proxy, WAF, and application logs for /c/router requests containing getImageByPath, traversal sequences, absolute file paths, or attempts to read sensitive system/configuration files.
• Review backup-server file access, authentication, and process execution telemetry for unusual reads of configuration files, unexpected outbound connections, or use of recovered credentials from new source systems.
• Validate backup integrity, immutability, and restore capability; check for deleted, altered, or encrypted recovery points.
• Prioritize incident response for any exposed vulnerable instance because the EPSS score is very high and exploitation is confirmed in the wild.