CVE-2021-21546 in NetWorker
Summary
by MITRE • 07/29/2021
Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vulnerability. A local low-privileged user of the Networker server could potentially exploit this vulnerability to read plain-text credentials from server log files.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2021
The vulnerability identified as CVE-2021-21546 affects Dell EMC NetWorker server software across versions 18.x and 19.x prior to specific patch levels. This represents a significant information disclosure weakness that directly impacts the security posture of organizations relying on these backup and recovery systems. The flaw manifests when plain-text credentials are inadvertently written to server log files, creating an avenue for unauthorized access to sensitive authentication data. The vulnerability specifically targets local users with low privileges, which means that even users who do not possess administrative rights could potentially exploit this weakness to gain access to credential information that should remain protected.
The technical implementation of this vulnerability stems from inadequate logging practices within the NetWorker server software where authentication credentials are stored in plain text format within log files rather than being properly sanitized or encrypted. This design flaw allows local users to access these log files and extract sensitive information including usernames, passwords, and potentially other authentication tokens. The vulnerability aligns with CWE-200, which describes improper exposure of sensitive information, and represents a classic case of insecure logging practices that violate fundamental security principles. From an operational perspective, this vulnerability creates a persistent risk as log files typically contain comprehensive system information and are often stored in accessible locations on the server filesystem.
The impact of this vulnerability extends beyond simple credential theft as it can enable attackers to escalate privileges and gain deeper access to the system. A local low-privileged user who discovers these credentials can potentially use them to authenticate as other users or services, leading to unauthorized access to backup data, system configuration changes, or even lateral movement within the network. This weakness creates a vector for privilege escalation attacks and can significantly compromise the integrity of the backup infrastructure. The ATT&CK framework categorizes this vulnerability under T1078 Valid Accounts and T1566 Phishing as it enables adversaries to obtain legitimate credentials that can be used for further exploitation. Organizations using affected NetWorker versions face increased risk of data breaches and unauthorized access to critical backup systems, particularly in environments where backup servers contain sensitive data and administrative privileges.
Mitigation strategies for CVE-2021-21546 require immediate patching of affected systems to version 19.3.0.4 or 19.4.0.0, which contain the necessary security fixes to prevent plain-text credential logging. System administrators should also implement enhanced log file monitoring and access controls to prevent unauthorized users from accessing log directories. Additional measures include configuring log rotation with proper permissions, implementing centralized logging with secure storage, and conducting regular security audits to identify potential information disclosure vulnerabilities. Organizations should also review their overall logging practices to ensure that sensitive information is never written to plain text files and implement proper credential management protocols that align with security standards such as NIST SP 800-53 and ISO 27001. Regular security training for system administrators on secure logging practices and proper credential handling procedures is essential to prevent similar vulnerabilities from occurring in other components of the backup infrastructure.