CVE-2022-45461 in NetBackup
Summary
by MITRE • 11/17/2022
The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/29/2025
The vulnerability identified as CVE-2022-45461 represents a critical privilege escalation flaw within the Java Admin Console component of Veritas NetBackup versions up to 10.1 across Linux and UNIX platforms. This issue specifically targets the authentication and authorization mechanisms that govern access to administrative functions within the NetBackup ecosystem. The vulnerability stems from improper privilege handling within the console's command execution framework, where authenticated users who have been explicitly granted access through the auth.conf configuration file can leverage their privileges to execute arbitrary commands with root-level system permissions.
The technical exploitation of this vulnerability occurs through the manipulation of the Java Admin Console's authentication subsystem, which fails to properly validate or restrict command execution privileges for users who have been granted access through the auth.conf file. This flaw allows authenticated non-root users to bypass normal security boundaries and escalate their privileges to the root level, effectively granting them complete control over the underlying operating system. The vulnerability specifically affects the command execution pathways within the NetBackup administrative interface, where user input is not adequately sanitized or validated before being processed as system commands.
The operational impact of CVE-2022-45461 is severe and far-reaching, as it enables attackers who have gained initial access to the NetBackup system to achieve complete system compromise. Once exploited, the vulnerability allows for arbitrary code execution with root privileges, potentially enabling attackers to install malware, modify system configurations, exfiltrate sensitive data, or establish persistent backdoors within the network infrastructure. This privilege escalation capability undermines the fundamental security model of the NetBackup system and exposes organizations to significant risks including data breaches, system corruption, and unauthorized access to critical network resources. The vulnerability particularly affects enterprise environments where NetBackup is used for backup and recovery operations, as these systems often contain sensitive organizational data and operate with elevated privileges.
Security mitigations for this vulnerability should focus on immediate patching of affected Veritas NetBackup installations to version 10.1 or later, which contains the necessary fixes for the privilege escalation flaw. Organizations should also implement strict access controls and monitoring of the auth.conf file to limit the number of users granted administrative privileges. Network segmentation and firewall rules should be configured to restrict access to the Java Admin Console to only trusted administrative workstations. Additionally, security teams should conduct comprehensive audits of existing administrative accounts and implement principle of least privilege practices. From a compliance perspective, this vulnerability aligns with CWE-276, which addresses improper privileges, and maps to ATT&CK technique T1068, which covers privilege escalation through local commands. Organizations should also consider implementing privileged access management solutions and regular security assessments to identify similar vulnerabilities in their backup and recovery infrastructure.