Experts published PoC exploits for Arcserve UDP authentication bypass issue

Data protection firm Arcserve addressed an authentication bypass vulnerability in its Unified Data Protection (UDP) backup software.

Data protection vendor Arcserve addressed a high-severity bypass authentication flaw, tracked as CVE-2023-26258, in its Unified Data Protection (UDP) backup software. Threat actors can exploit the vulnerability to bypass authentication and gain admin privileges.

Arcserve Unified Data Protection (UDP) software delivers an all-in-one data and ransomware protection solution to neutralize ransomware attacks, restore data, and perform effective disaster recovery (DR).

The vulnerability was discovered by researchers from MDSec ActiveBreach during a simulation of a ransomware attack. The experts were attempting to compromise the organization’s backup infrastructure.

“During a recent adversary simulation, the MDSec ActiveBreach red team were performing a ransomware scenario, with a key objective set on compromising the organisation’s backup infrastructure.” reads the analysis published by the researchers. “As part of this simulation, Juan Manuel Fernandez and Sean Doherty carried out a detailed analysis of the software used to perform backups (ArcServe UDP). Within minutes of analysing the code, a critical authentication bypass was discovered that allowed access to the administration interface.”

The experts analyzed the traffic between their browser and the UDP admin interface and captured SOAP requests containing AuthUUIDs. Then the researchers demonstrated how to obtain admin credentials from the requests. Once obtained the credentials, the attackers decrypt them to delete the backups as part of the simulated ransomware attack.

“Even if the vulnerability is patched, it is possible to obtain the credentials of the administrator user in different ways. Of course, all of them imply certain privileges or default credentials.” continues the post. “Examples include: From the database: If the MSSQL database is still configured with the default creds and From the registry“.

The researchers published proof-of-concept (PoC) exploits to scan Arcserve UDP instances with default configuration on local networks, obtain encrypted admin credentials by exploiting the above issue, and decrypt the credentials.

“Finally, if the ArcServe version was not patched (CVE-2023-26258) it is possible to exploit an authentication bypass in the management web interface and retrieve the admin creds (ArcServe-exploit.py)” continues the report.

The issue was discovered on 09/02/2023 and on 27/06/2023 ArcServe releases the patch without credits.

Arcserve released UDP 9.1 to address the vulnerability that impacts systems running Arcserve UDP 7.0 up to 9.0.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, backup)