PT-2020-14792 · Acronis · Acronis Cyber Backup
Julien Ahrens
·
Published
2020-09-15
·
Updated
2020-10-01
·
CVE-2020-16171
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Acronis Cyber Backup versions prior to 12.5 Build 16342
Description
An issue was discovered in Acronis Cyber Backup where some API endpoints on port 9877 under "/api/ams/" accept an additional custom
Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct Server-Side Request Forgery (SSRF) attacks against otherwise unreachable Acronis services that are bound to localhost, such as the NotificationService on 127.0.0.1:30572.Recommendations
For versions prior to 12.5 Build 16342, update to version 12.5 Build 16342 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoints under "/api/ams/" to minimize the risk of exploitation. Avoid using the custom
Shard header in requests to these endpoints until the issue is resolved.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Acronis Cyber Backup