CVE-2024-48248
CVE-2024-48248: A critical path traversal vulnerability affects NAKIVO Backup & Replication. This flaw allows attackers to read arbitrary files using absolute path traversal, potentially exposing sensitive data and enabling remote code execution.
CVE-2024-48248 in NAKIVO Backup & Replication before version 11.0.0.88174 enables unauthorized file access through the getImageByPath function in the /c/router endpoint. The SVRS score of 79 indicates a high-risk vulnerability requiring prompt attention. This is because the vulnerability can expose cleartext credentials leading to complete compromise of the enterprise. With exploits actively circulating and identified as "In The Wild", immediate patching is crucial to mitigate potential attacks. The vulnerability is further highlighted by inclusion in the CISA KEV catalog. Successful exploitation could grant attackers significant control over the backup and replication environment and the assets it protects.
Description
CVE-2024-48248 is a critical vulnerability affecting NAKIVO Backup & Replication versions prior to 11.0.0.88174. It involves an absolute path traversal vulnerability through the getImageByPath function in the /c/router endpoint, potentially allowing unauthorized reading of arbitrary files on the system. Given the SVRS score of 82, this vulnerability is considered critical and necessitates immediate attention. The description specifies this vulnerability "may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials". The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
Key Insights
- Remote Code Execution Risk: The vulnerability can expose cleartext credentials within the
PhysicalDiscoveryfunctionality, potentially leading to remote code execution across the entire enterprise network. The ability to read arbitrary files via path traversal amplifies the risk. - Actively Exploited: The vulnerability is actively exploited by hackers "In The Wild," increasing the urgency for patching and mitigation.
- CISA KEV Designation: The Cybersecurity and Infrastructure Security Agency (CISA) has included this vulnerability in its Known Exploited Vulnerabilities (KEV) catalog, indicating it poses a significant risk to federal agencies and encouraging all organizations to prioritize remediation. Active exploits have been published to exploit the vulnerability.
- Exploit Availability: There are active exploits have been published to exploit the vulnerability.
Mitigation Strategies
- Immediate Patching: Upgrade NAKIVO Backup & Replication to version 11.0.0.88174 or later to remediate the vulnerability. This is the most critical step to prevent exploitation.
- Credential Rotation: If an upgrade is not immediately feasible, rotate all credentials potentially exposed by the
PhysicalDiscoveryfunctionality, especially those used by NAKIVO Backup & Replication. - Network Segmentation: Implement network segmentation to limit the potential impact of a successful exploit. Restrict access to sensitive systems and data from the NAKIVO Backup & Replication server.
- Web Application Firewall (WAF) Rules: Deploy or update WAF rules to detect and block path traversal attempts targeting the
/c/routerendpoint. Consider input validation to prevent malicious requests.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.