CVE-2020-16171: 
Acronis Cyber Backup vulnerability analysis and mitigation

An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342, reported and disclosed on September 14, 2020. The vulnerability affects API endpoints on port 9877 under /api/ams/ that accept an additional custom Shard header, which can be exploited without authentication (NVD, RCE Security).

The vulnerability is classified as a Server-Side Request Forgery (SSRF) with a CVSS v3.1 Base Score of 6.5 (Medium). The issue stems from the application's handling of the Shard header value, which is used to construct a separate web request issued by the application itself through urllib.request.urlopen. The vulnerability exists in the make_request_to_ams method where the header value is used without proper validation (RCE Security).

The vulnerability allows attackers to conduct SSRF attacks against otherwise unreachable Acronis services that are bound to localhost, such as the NotificationService on 127.0.0.1:30572. This can be exploited to send customized emails with attachments or modify application resource settings without authentication (Full Disclosure, RCE Security).

The vulnerability can be exploited by unauthenticated attackers through the /api/ams/agents endpoint, which is accessible without authentication. The exploit involves sending a specially crafted HTTP request with a manipulated Shard header to trigger the SSRF condition (RCE Security).

The vulnerability was fixed in Acronis Cyber Backup v12.5 Build 16342. The fix involves changes to the get_ams_address method, which now requires additional authorization through a JWT token and implements proper validation of the Shard address resolution (RCE Security).