Exagrid 4.8.1.1044.P50 Directory Traversal Leads to Unauthenticated Admin Credential Disclosure

Summary The Exagrid backup appliance at version 4.8.1.1044.P50 is affected by a directory traversal vulnerability located at "http://EXAGRID_IP/monitor/data/Upgrade/" (case-sensitive), which permits unauthenticated access to detailed log files. Within these logs, active "support" credentials were discovered in Base64-encoded format. These credentials were confirmed to be used for facilitating upgrades on the appliance via a series of Perl scripts. Execution of one such script writes the encoded credentials into the log file "progress.log" within this directory. Once decoded, these 'support' credentials grant administrative-level access to the appliance and its data. Identification The vulnerability was identified by running the web content scanning tool 'DIRB' against the Exagrid web console. The scan revealed the URL "http://EXAGRID_IP/monitor/data/Upgrade/". Accessing the directory exposes the "progress.log" file, which contains Base64-encoded credentials. Impact Significant — The process was tested on multiple Exagrid systems and consistently identifies administrative 'support' credentials on appliances upgraded to the affected version. Mitigation The vulnerability was responsibly disclosed to Exagrid. Users should contact their support representatives for information regarding available updates. Credentials can be reset with assistance from Exagrid support. Disclosure Timeline 7/10/2018: Vulnerability identified; Exagrid support contacted. 7/13/2018: Exagrid support confirmed the issue. 7/19/2018: Final communication received from Exagrid. 5/23/2019: Disclosure to MITRE for CVE assignment. 6/4/2019: CVE assigned and published.

Goal Reached Thanks to every supporter — we hit 100%!

Exagrid 4.8.1.1044.P50 Directory Traversal Leads to Unauthenticated Admin Credential Disclosure