Acronis · Report #1901713
IDOR in backup recovery functionality
Validstatus
highseverity
56upvotes
13 Nov 2024disclosed
Summary
IDOR in backup recovery functionality allowed an authenticated attacker knowing user's machine UUID, backup ID and some other parameters to configure and run recovery plan.
We have seen no signs of the exploitation of this vulnerability.
Access Control Flaw Leading to Critical Data Deletion through Backup Overwrite Exploit {F3758159}
How it was found
Summary
Hi team I hope you are well, there is an issue let me to takeover any backup via recover it to my machine.
Steps To Reproduce
- Login https://mc-beta-cloud.acronis.com
- Visit the DEVICES section [you must have 2 devices]
- Click on any device has a backup [device_1]
- Click on recovery > select machine > select the second machine [device_2]
- follow the steps to recover the backup to [device_2]
- In the burp search for this endpoint
/bc/api/ams/recovery/plan_operations/run - Send the request again via ==X-Apigw-Session== session from another organization.
POC
{F2222128}
Impact
- Backup Takeover via recovery function.