The Shadowserver Foundation has reported detecting 208 vulnerable instances of Nakivo Backup & Replication software affected by CVE-2024-48248, a critical vulnerability that enables arbitrary file reads. A critical vulnerability tracked as CVE-2024-48248, has been discovered in the Nakivo Backup & Replication tool, exposing systems to unauthenticated arbitrary file read attacks. This vulnerability allows attackers to access sensitive files on targeted systems without authentication, posing significant risks to organizations relying on Nakivo for data protection. Researchers demonstrated how an attacker could use this vulnerability to extract sensitive data, including backup logs and database files containing credentials for integrated systems like AWS S3 buckets and SSH-enabled servers. We are scanning for & reporting Nakivo Backup & Replication CVE-2024-48248 (arbitrary file read) vulnerable instances in our Vulnerable HTTP report: . The vulnerability poses a high risk to organizations using unpatched Nakivo Backup & Replication versions. The vulnerability is further exacerbated by the fact that Nakivo often runs with elevated privileges, granting access to critical system files such as / etc/shadow on Linux or C:\windows\win.ini on Windows. Backup solutions like Nakivo are attractive targets for attackers due to their access to critical infrastructure data. WatchTowr Labs has released a proof-of-concept (PoC) exploit that showcases how attackers can use this vulnerability to read sensitive files. Attackers could potentially access sensitive backups, credentials, and other critical data stored within the system. The PoC highlights the ease with which an attacker can exfiltrate backup logs and other critical data, potentially leading to full compromise of the targeted infrastructure. This method processes user-supplied file paths without proper validation, enabling attackers to read arbitrary files on the underlying system. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 28 Feb 2025 13:20:04 +0000