CVE-2022-3405: 
Acronis Cyber Backup vulnerability analysis and mitigation

CVE-2022-3405 is a critical vulnerability affecting Acronis Cyber Protect 15 (Windows, Linux) before build 29486 and Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545. The vulnerability stems from excessive privileges assigned to the Acronis Agent, which can lead to code execution and sensitive information disclosure (NVD, USD HeroLab).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) by NIST with vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while Acronis International GmbH rated it as 9.3 (CRITICAL) with vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. The vulnerability is related to CWE-269 (Improper Privilege Management) and allows for authentication bypass with subsequent remote command execution (NVD).

The vulnerability allows attackers to execute arbitrary commands on both the agents and the appliance itself, leading to complete compromise of all agents and the appliance. Additionally, it enables sensitive information disclosure and provides attackers with administrative access to the API using access tokens that remain valid for 30 days (USD HeroLab).

The vulnerability is highly exploitable as it requires no authentication and can be triggered through the API endpoint that allows anonymous registration of new backup/protection agents. The exploit path involves obtaining bearer tokens through the agent registration process, which can then be used to authenticate to the appliance and execute arbitrary commands (USD HeroLab).

The vulnerability has been fixed in Acronis Cyber Protect 15 build 29486 and Acronis Cyber Backup 12.5 build 16545. The recommended mitigation involves disabling anonymous registration by default and limiting the scope of bearer tokens for agents to only the required functions (USD HeroLab).