CVE-2021-27876
published 2021-03-01CVE-2021-27876: An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is…
PriorityP193high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2023-04-28
Exploited in the wild
EPSS
13.41%
95.9th percentile
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| veritas | backup_exec | < 21.2 | 21.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2021-27876 affects Veritas Backup Exec Agent versions 16.x, 20.x, and 21.x up to 21.2 (up to and including Remote Agent revision 9.3); detect exploitation attempts targeting the SHA authentication scheme on the BE Agent communication port ↗
- →Exploitation of CVE-2021-27876 results in command execution as NT AUTHORITY\SYSTEM (Windows) or root (Linux/Unix); alert on Backup Exec Agent processes spawning unexpected child processes with elevated privileges ↗
- →The attack abuses the SHA authentication scheme on the Veritas BE Agent; monitor for unauthenticated or anomalous SHA-scheme authentication attempts against the Backup Exec Agent service, particularly followed by data management protocol commands with crafted input parameters ↗
- ·The Talos IR report incorrectly attributes CVE-2021-27876 to 'Zoho ManageEngine ADSelfService Plus'; CVE-2021-27876 is a Veritas Backup Exec Agent vulnerability. Analysts should not use the Talos report's product attribution for this CVE. ↗
- ·The SHA authentication scheme exploited by CVE-2021-27876 is a legacy scheme no longer actively used within Backup Exec versions but was not disabled prior to version 21.2; patching to 21.2 or later is required to disable it. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.07.5HIGHAV:N/AC:L/Au:S/C:C/I:P/A:N
vulncheck8.1HIGH
cisa8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Veritas Backup Exec Agent File Access Vulnerability
cisa·2023-04-07·CVSS 8.1
CVE-2021-27876 [HIGH] CWE-287 Veritas Backup Exec Agent File Access Vulnerability
Vulnerability: Veritas Backup Exec Agent File Access Vulnerability
Affected: Veritas Backup Exec Agent
Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.
Required Action: Apply updates per vendor instructions.
Notes: https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27876
Remediation Due Date: 2023-04-28
GHSA
GHSA-9j5v-h34p-h6g6: An issue was discovered in Veritas Backup Exec before 21
ghsa_unreviewed·2022-05-24
CVE-2021-27876 [HIGH] CWE-287 GHSA-9j5v-h34p-h6g6: An issue was discovered in Veritas Backup Exec before 21
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
VulnCheck
Veritas Backup Exec Agent File Access Vulnerability
vulncheck·2021·CVSS 8.1
CVE-2021-27876 [HIGH] CWE-287 Veritas Backup Exec Agent File Access Vulnerability
Veritas Backup Exec Agent File Access Vulnerability
Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.
Affected: Veritas Backup Exec Agent
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.mandiant.com/resources/blog/alphv-ransomware-backup; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.at-bay.com/articles/avoslocker-adds-veritas-vulnerabilities-to-access-arsenal/; https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape; https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf; h
No detection rules found.
Talos
Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
blogs_talos·2024-04-25
Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
Business email compromise (BEC) was the top threat observed by Cisco Talos Incident Response (Talos IR) in the first quarter of 2024, accounting for nearly half of engagements, which is more than double what was observed in the previous quarter.
The most observed means of gaining initial access was the use of compromised credentials on valid accounts, which accounted for 29 percent of engagements. The high number of BEC attacks likely played a significant role in valid accounts being the top attack vector this quarter. Weaknesses involving multi-factor authentication (MFA) were observed within nearly half of engagements this quarter, with the top observed weakness being users accepting unauthorized push notifications, occurring within 25 percent of engagements.
Talos IR Quarterly Trends
Talos
Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
blogs_talos·2024-04-25
Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
## Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
Business email compromise (BEC) was the top threat observed by Cisco Talos Incident Response (Talos IR) in the first quarter of 2024, accounting for nearly half of engagements, which is more than double what was observed in the previous quarter .
The most observed means of gaining initial access was the use of compromised credentials on valid accounts, which accounted for 29 percent of engagements. The high number of BEC attacks likely played a significant role in valid accounts being the top attack vector this quarter. Weaknesses involving multi-factor authentication (MFA) were observed within nearly half of engagements this quarter, with the top observed weakness being users accepting unauthorized push notifications
http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.htmlhttps://www.veritas.com/content/support/en_US/security/VTS21-001#issue2http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.htmlhttps://www.veritas.com/content/support/en_US/security/VTS21-001#issue2https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27876
2021-03-01
Published
2023-04-07
Added to CISA KEV
Exploited in the wild