CVE-2022-30995: 
Acronis Cyber Backup vulnerability analysis and mitigation

CVE-2022-30995 is a sensitive information disclosure vulnerability due to improper authentication affecting Acronis Cyber Protect 15 (Windows, Linux) before build 29486 and Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545. The vulnerability was disclosed on May 3, 2023 (NVD).

The vulnerability stems from a design flaw where agents installed on endpoints can register without any authentication on the Acronis appliance. This authentication bypass vulnerability has received a CVSS v3.1 base score of 7.5 (High) from NIST and 9.3 (Critical) from Acronis International GmbH. The vulnerability is classified as CWE-287: Improper Authentication (NVD, AttackerKB).

The vulnerability allows unauthenticated attackers to gain full admin access on the Acronis appliance. Since the agent registration access is at the admin level, attackers can potentially gain full control of the appliance and all registered endpoints, creating a significant security risk for organizations (AttackerKB).

The vulnerability is considered highly exploitable as it requires no authentication and can be exploited through the network. A Metasploit module (auxiliary/gather/acronis_cyber_protect_machine_info_disclosure) has been developed to exploit this vulnerability. The attack can be executed through a specific sequence of HTTP requests to obtain access tokens and register unauthorized agents (AttackerKB).

Organizations using affected versions should upgrade Acronis Cyber Protect 15 to build 29486 or later, and Acronis Cyber Backup 12.5 to build 16545 or later (NVD).