CVE-2021-27876 Veritas Backup Exec Agent File Access
An authentication bypass in Veritas Backup Exec allows attackers to execute commands and read arbitrary files with System privileges.
- Exploited in the wild
- Since 7 Apr 2023
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27876?
CVE-2021-27876 is a high-severity authentication bypass vulnerability in n/a, published on 1 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
Which versions are affected by CVE-2021-27876?
It affects 1 product.
Products include Veritas Backup Exec.
How do I fix CVE-2021-27876?
No fix has been published for CVE-2021-27876 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Apr 2023.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-27876 being exploited?
Yes. Attackers have exploited CVE-2021-27876 in the wild since at least 7 Apr 2023, including in ransomware campaigns.
Public exploit code: 1 Metasploit module and 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9j5v-h34p-h6g6.