CVE-2020-27858

Executive Summary

CVE-2020-27858 is an unauthenticated XML External Entity (XXE) injection vulnerability affecting CA Arcserve D2D version 16.5. The flaw resides in the getNews method, where improper restriction of XXE references allows a remote, unauthenticated attacker to craft a malicious XML document that causes the parser to access arbitrary URIs, including local files, and embed the contents into the response. This results in sensitive information disclosure in the context of the SYSTEM user. The vulnerability carries a CVSS score of 7.5 (High) and an EPSS score of 0.73828, placing it in the 99.4th percentile of exploited CVEs, indicating active threat actor interest. No patch has been identified from any tracked source, leaving all deployments of Arcserve D2D 16.5 exposed.

Technical Analysis

The vulnerability is classified as an XML External Entity (XXE) injection flaw, corresponding to CWE-611 (Improper Restriction of XML External Entity References). The affected component is the getNews method within CA Arcserve D2D 16.5. This method is designed to retrieve news or feed content, presumably in XML format, for display within the management console.

XXE vulnerabilities occur when an XML parser processes document type definitions (DTDs) with external entity declarations without adequate restrictions. In this specific case, the XML parser fails to disable or restrict external entity references. A crafted XML document can declare an external entity that references a URI — either a file:// path for local file disclosure or an http:///ftp:// URI for server-side request forgery (SSRF) and network reconnaissance.

The attack mechanism works as follows: the XML parser receives a specially-crafted document where an entity is declared and then referenced within the document body. The parser resolves this entity by accessing the URI specified, retrieves the contents, which may be a local file like C:\Windows\win.ini, configuration files containing credentials, or database connection strings, and embeds the returned content back into the XML document. This processed document is then returned to the attacker in the HTTP response, effectively exfiltrating the file contents.

Because the flaw is in the XML parsing logic itself and not in any authentication mechanism, no credentials are required. The service listens on the network and processes XML input without verifying the identity of the requester. The vulnerability allows disclosure of information in the context of SYSTEM, meaning the attacker can read any file readable by the SYSTEM account on the host operating system, including password hashes (SAM/SYSTEM registry hives), application credentials, and other sensitive configuration data.

The specific URI handling and the exact way the parser is invoked are not disclosed in the provided NVD description. The description only names the getNews method, which is a function within the application's business logic that appears to accept XML input over the network without authentication.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification. An attacker scans for hosts running CA Arcserve D2D 16.5. The management web interface typically listens on a well-known port (commonly 8014 or similar, though the specific port is not confirmed in the CVE description). Shodan queries such as product:"CA Arcserve D2D" or http.title:"Arcserve D2D" can identify exposed instances. The attacker also verifies that the service is unauthenticated by sending an unauthenticated request to the management interface.

Step 2: Triggering the Flaw. The attacker constructs an HTTP request targeting the getNews method. The request body contains a crafted XML document with an external entity declaration. No authentication headers or session tokens are required because the endpoint is accessible without authentication.

Step 3: Payload and Execution. The attacker crafts a payload resembling the following structure (conceptually, at the vulnerability-class level, since exact XML structure is not disclosed):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
]>
<news>&xxe;</news>

When the XML parser processes this document, it resolves the xxe entity by reading the specified file and substitutes the file's contents into the XML document. The application then processes and returns the resulting document in the HTTP response. The attacker receives the file contents embedded in the response.

Alternative payloads could target other files: file:///c:/windows/system32/config/sam, file:///c:/ProgramData/Arcserve/... for backup configuration files containing credentials, or network URIs for internal port scanning and SSRF.

Step 4: Post-Exploitation Impact. The attacker can systematically read critical files from the target host: Windows registry hive files (SAM, SYSTEM), which contain local user password hashes; Arcserve configuration files that may contain database credentials and backup encryption keys; and other application configuration files with secrets. With SYSTEM-level read access, the attacker can gather enough information to move laterally within the network, potentially compromising backup infrastructure — a high-value target because backups often contain crown-jewel data. The attacker may also pivot to the internal network using SSRF capabilities.

No public PoC is documented for this CVE; the attack chain is inferred from the XXE vulnerability class and standard exploitation techniques. The EPSS score of 0.73828 (99.4th percentile) strongly suggests that threat actors are actively scanning for and exploiting this vulnerability in the wild, or that it is part of active exploitation toolkits.

Impact Assessment

This vulnerability has a high confidentiality impact with no impact on integrity or availability, as reflected in the CVSS vector. The CVSS score of 7.5 (High) is primarily driven by the fact that exploitation requires no authentication, no user interaction, and no special privileges, while yielding SYSTEM-level read access to sensitive data.

Affected Systems: All installations of CA Arcserve D2D 16.5 are affected. Backup management appliances and servers running this version are exposed if the management interface is reachable from the network. Organizations running Arcserve D2D as a backup solution for virtual or physical servers are at risk.

Business Impact: Backup systems are high-value targets because they contain complete copies of production data, including sensitive business information, credentials, and encryption keys. An attacker who breaches a backup console can gain insight into the entire IT infrastructure, potentially extracting:

• Active Directory credentials and domain trust relationships
• Database connection strings and cloud storage credentials
• Backup encryption keys that protect all backup data
• Configuration details of the entire backup infrastructure

Blast Radius: The immediate blast radius is the Arcserve D2D host itself, with SYSTEM-level file read capability. However, the information gleaned can expand the attack surface significantly. Stolen credentials can be used to compromise other systems, and knowledge of backup schedules can aid ransomware actors in maximizing impact by deleting or encrypting backups before launching ransomware on production systems.

The vulnerability's presence in backup management software makes it particularly dangerous for disaster recovery scenarios. If an attacker can compromise the backup system, they can severely undermine the organization's ability to recover from a subsequent ransomware attack. This is a common pattern in double-extortion ransomware campaigns where attackers target backup infrastructure first.

Detection Guidance

Sigma Rule

title: Arcserve D2D XXE Exploitation Attempt
id: 8f3b5e9c-2a4d-4f7a-9b3d-1c6e8a2f4b7d
status: experimental
description: Detects XXE payloads targeting the getNews method in CA Arcserve D2D 16.5
author: valtersit.com Threat Intel Team
date: 2025/01/14
logsource:
  category: webserver
  product: arcserve
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-path:
      - '*/getNews*'
  selection_xxe_indicators:
    cs-body|contains|all:
      - 'DOCTYPE'
      - 'SYSTEM'
    cs-body|contains|any:
      - 'file://'
      - 'http://'
      - 'ftp://'
      - '/etc/passwd'
      - 'windows/win.ini'
      - 'boot.ini'
  condition: selection_method and selection_path and selection_xxe_indicators
falsepositives:
  - Legitimate XML processing if the application uses external DTDs (unlikely in this context)
level: high

YARA Rule

rule Arcserve_D2D_XXE_Exploit_Payloads {
    meta:
        author = "valtersit.com Threat Intel Team"
        description = "Detects XXE payloads targeting Arcserve D2D getNews method"
        date = "2025-01-14"
        cve = "CVE-2020-27858"
        severity = "high"
    strings:
        $s1 = "getNews" ascii nocase
        $s2 = "<!DOCTYPE" ascii nocase
        $s3 = "SYSTEM" ascii nocase
        $s4 = "file:///" ascii nocase
        $s5 = "http://" ascii nocase
        $s6 = "ftp://" ascii nocase
        $s7 = "ENTITY" ascii nocase
        $s8 = "c:/windows" ascii nocase
        $s9 = "/etc/" ascii nocase
    condition:
        filesize < 100KB and
        $s1 and $s2 and $s3 and $s7 and
        2 of ($s4, $s5, $s6, $s8, $s9)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2020-27858 Arcserve D2D XXE exploitation attempt"; flow:established,to_server; content:"POST"; http_method; content:"getNews"; http_uri; nocase; content:"<!DOCTYPE"; http_client_body; nocase; content:"SYSTEM"; http_client_body; nocase; content:"file://"; http_client_body; nocase; sid:202027858; rev:1; reference:cve,2020-27858; metadata:created_at 2025-01-14, updated_at 2025-01-14, author valtersit_threat_intel, cwe 611; classtype:attempted-user; priority:1;)

Elastic Detection

sequence by process.entity_id with maxspan=1s
  [network where destination.port != null and
   network.protocol == "http" and
   process.name != null and
   // Arcserve D2D service process
   process.name : ("*arcserve*", "*d2d*")]
  [file where event.action == "open" and
   // Suspicious file access following XXE trigger
   file.name in ("win.ini", "sam", "system", "passwd", "shadow", "*.conf", "*.ini") and
   file.path : ("*\\\\windows\\\\*", "/etc/*", "*\\\\Program Files\\\\Arcserve*")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| search uri_path="*getNews*" OR uri_path="*/getNews"
| search body="*<!DOCTYPE*" OR body="*SYSTEM*" OR body="*file://*" OR body="*http://*" OR body="*ftp://*"
| eval attack_signature=if(match(body, "file://|http://|ftp://"), "XXE-URI-Specification", "XXE-Possible")
| table _time, src_ip, dest_ip, uri_path, method, attack_signature
| stats count by src_ip, dest_ip, uri_path, attack_signature
| where count > 1

Alternative detection using HTTP request bodies:

index=proxy OR index=web
| regex _raw="(!DOCTYPE|ENTITY|SYSTEM).*(file://|ftp://|http://)"
| regex _raw="getNews"
| table _time, src_ip, url, method
| sort -_time

Wazuh OSSEC Rule

<group name="arcserve_d2d_xxe,">
  <rule id="100278" level="12">
    <decoded_as>web</decoded_as>
    <match>getNews</match>
    <regex>DOCTYPE|SYSTEM|file://|http://|ftp://</regex>
    <description>Possible XXE exploitation attempt against Arcserve D2D getNews method (CVE-2020-27858)</description>
    <mitre><id>T1190</id></mitre>
    <group>attack_exploitation,</group>
    <info type="cve">CVE-2020-27858</info>
  </rule>
  
  <rule id="100279" level="10">
    <decoded_as>web</decoded_as>
    <match>getNews</match>
    <regex>DOCTYPE|ENTITY</regex>
    <description>Arcserve D2D getNews method called with XML entity declaration</description>
    <group>attack_exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: No patch is available from any tracked source (patch confidence: 0/4). The vendor has not released a security update for this vulnerability as of the analysis date. Arcserve D2D 16.5 remains vulnerable.

Immediate Mitigations:

1. Network Segmentation: Restrict access to the Arcserve D2D management interface to trusted administrative networks only. Use firewall rules to block external access to the management port. If remote access is necessary, use a VPN with MFA.
2. Access Control: Implement IP whitelisting on the management interface to allow only known administrative IP addresses.
3. Disable Unused Features: If the getNews functionality (news/feed display) is not essential for operations, disable it or block access to that specific endpoint at the web application firewall (WAF) level.
4. Web Application Firewall (WAF): Deploy a WAF in front of the Arcserve D2D interface with rules to block requests containing XXE signatures (DOCTYPE, SYSTEM, file://, external entity references).
5. Proxy/Reverse Proxy: Place a reverse proxy or application gateway in front of the service to filter and sanitize incoming XML requests.

Patch/Upgrade Steps:

1. Monitor vendor advisories at the Arcserve security portal and vendor website for any announced fixes.
2. Contact Arcserve support directly to inquire about the patch status for CVE-2020-27858 and subscribe to security advisories.
3. If an upgrade path becomes available (e.g., a newer version of Arcserve D2D beyond 16.5), plan an upgrade window and test the upgrade in a staging environment before production deployment.
4. Until a patch is available, treat the vulnerability as permanently exploitable and prioritize the network/access mitigations above.

Long-Term Hardening:

1. Vendor Governance: If Arcserve is unable to fix this vulnerability in a timely manner, evaluate alternative backup solutions from vendors with stronger security track records. Consider this an SLA breach in terms of security maintenance.
2. Credential Hygiene: Since SYSTEM-level file access can expose credentials, ensure that service account passwords are rotated regularly and are not reused across systems. Store backup credentials in a centralized secrets manager.
3. File System Hardening: Apply least-privilege principles on the Arcserve D2D host. Restrict file system access for the service account to only necessary directories. Harden the OS and apply all Microsoft security patches.
4. Monitor Backup Integrity: Implement backup integrity monitoring to detect tampering. Regularly test restoration capabilities to ensure that a compromise of the backup system does not go unnoticed.
5. Incident Response Preparedness: Include backup systems as critical assets in incident response playbooks. Ensure that IR teams can detect and respond to the first signs of backup infrastructure compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-27858
2. Trend Micro ZDI Advisory (ZDI-CAN-11103): https://www.zerodayinitiative.com/advisories/ZDI-CAN-11103/ (Note: advisory title may differ from CVE description; the ZDI-CAN reference is cited in the CVE record)
3. Arcserve Support Portal: https://support.arcserve.com (for vendor security advisories and patch announcements)
4. FIRST EPSS Score Distribution: https://www.first.org/epss/ (EPSS for CVE-2020-27858: 0.73828, 99.4th percentile)

Threat Actor Activity: As of the analysis date, CVE-2020-27858 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. No public exploit code or PoC has been released, and no specific threat actor campaigns targeting this CVE have been documented. However, the high EPSS percentile score (99.4%) indicates that the vulnerability is of significant interest to automated scanning and exploitation frameworks, suggesting active or imminent exploitation attempts in the wild. Backup software is a frequent target for ransomware operators; monitor threat intel feeds for any newly emerging campaign data referencing this CVE.