PT-2023-8529 · Vinchin · Vinchin Backup & Recovery

Gregory Boddin · Publicado 2023-10-25 · Atualizado 2023-12-29 · CVE-2023-45499

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VinChin Backup & Recovery versions 5.0.* through 7.0.*

Description The issue is related to hardcoded credentials in the software. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions 5.0.* through 7.0.*, consider changing the hardcoded credentials to unique, secure credentials as a temporary workaround until a patch is available. Restrict access to the software to minimize the risk of exploitation. Avoid using the software for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2024-01117

CVE-2023-45499

Produtos afetados

Vinchin Backup & Recovery

Referências · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vinchin_backup_recovery_cmd_inject.rb · Exploit
• 🔥 https://blog.leakix.net/2023/10/vinchin-backup-rce-chain · Exploit
• https://twitter.com/leak_ix/status/1717859319205515653 · Publicação no Twitter
• https://twitter.com/ksg93rd/status/1740222367463588318 · Publicação no Twitter
• http://seclists.org/fulldisclosure/2023/Oct/31 · Nota
• https://osv.dev/vulnerability/CVE-2023-45499 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/9671 · Publicação no Telegram
• http://packetstormsecurity.com/files/175397/VinChin-VMWare-Backup-7.0-Hardcoded-Credential-Remote-Code-Execution.html · Nota
• https://packetstormsecurity.com/files/176289/Vinchin-Backup-And-Recovery-Command-Injection.html · Nota
• https://t.me/cvenotify/60103 · Publicação no Telegram
• https://t.me/cvenotify/60181 · Publicação no Telegram
• https://twitter.com/PentestingN/status/1740261624366391614 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-45499 · Nota de Segurança
• https://twitter.com/TheHackForce/status/1740679947474383251 · Publicação no Twitter
• http://packetstormsecurity.com/files/176289/Vinchin-Backup-And-Recovery-Command-Injection.html · Nota