A vulnerability was found in Unitrends Backup up to 9.x (Backup Software). It has been declared as critical. Affected by this vulnerability is an unknown part. The manipulation of the argument LOGDIR as part of a Environment Variable leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges.

The bug was discovered 08/07/2017. The weakness was disclosed 08/07/2017 (Website). It is possible to read the advisory at support.unitrends.com. This vulnerability is known as CVE-2017-12479 since 08/04/2017. The attack can be launched remotely. A single authentication is necessary for exploitation. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 10.0.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (42959). The entries VDB-104946 and VDB-104945 are pretty similar.

Productinfo

Type

• Backup Software

Vendor

• Unitrends

Name

• Backup

Version

• 9.x

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion