Full Report
CISA has warned U.S. federal agencies to secure their networks against attacks exploiting a high-severity vulnerability in NAKIVO's Backup & Replication software. [...]
Analysis Summary
# Vulnerability: NAKIVO Backup Software Arbitrary File Read Vulnerability
## CVE Details
- CVE ID: CVE-2024-48248
- CVSS Score: Information not explicitly provided in text, but severity is high given active exploitation. Assume **High** criticality based on CISA inclusion.
- CWE: Not explicitly provided (Likely related to Improper Access Control or Path Traversal given LFI context implied by attack description).
## Affected Systems
- Products: NAKIVO Backup & Replication software
- Versions: Specific vulnerable versions are not listed, but all users should consult vendor advisories.
- Configurations: Applicable to NAKIVO installations.
## Vulnerability Description
The vulnerability is an arbitrary file read flaw within NAKIVO Backup & Replication software. While initially analyzed as an arbitrary file read, one security researcher noted that successful exploitation can lead to much wider impact, potentially "unlocking entire infrastructure environments," going beyond simple data exfiltration.
## Exploitation
- Status: **Actively exploited in the wild** (Tagged by CISA).
- Complexity: Implied to be successful by threat actors. Research suggests potential for exploitation for various goals.
- Attack Vector: Likely **Network** access, as it involves a third-party backup solution often exposed for remote management/data transfer.
## Impact
- Confidentiality: **High** (Potential for reading sensitive files, leading to infrastructure compromise).
- Integrity: **High** (Implied by the scope of potential infrastructure unlocking).
- Availability: **Not explicitly stated**, but unauthorized file access/system compromise inherently affects availability.
## Remediation
### Patches
- NAKIVO did not initially mark the vulnerability as exploited but subsequently released security measures. Users should consult the latest NAKIVO Security Advisory for the definitive patched version.
### Workarounds
- Organizations are advised to **check system logs for signs of "unauthorized access attempts" and "unexpected file access activities."**
## Detection
- **Indicators of Compromise (IOCs):** Look for indicators related to unauthorized access attempts or unexpected file access activities within NAKIVO system logs.
- **Detection Methods and Tools:** Monitor network traffic and system logs for unusual connection patterns to the NAKIVO service.
## References
- Vendor Advisory: hxxps://helpcenter.nakivo.com/Knowledge-Base/Content/Security-Advisory/CVE-2024-48248.htm
- CISA Catalog: hxxps://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Proof-of-Concept (PoC): hxxps://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248