CVE-2023-42000

Executive Summary

CVE-2023-42000 is a critical unauthenticated path traversal vulnerability affecting Arcserve UDP Agent prior to version 9.2. The flaw exists in the com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload() method, allowing a remote, unauthenticated attacker to upload arbitrary files to any location on the underlying file system where the UDP agent is installed. With a CVSS score of 9.8, this vulnerability enables full remote code execution, persistence, and system compromise without requiring any credentials or user interaction. The vulnerability remains unpatched with no official fix or workaround published.

Technical Analysis

The vulnerability resides in the file upload functionality of Arcserve UDP (Unified Data Protection) Agent, specifically within the FileHandlingServlet class and its doUpload() method. Arcserve UDP is a backup and disaster recovery solution deployed across enterprise environments, typically installed on servers to manage data protection workflows. The agent component runs as a background service and exposes an HTTP-based management interface for administrative operations.

The flaw is a classic path traversal vulnerability (CWE-22) in the file upload handling logic. The doUpload() method accepts file uploads from remote clients but fails to properly sanitize or validate the destination file path supplied by the client. By crafting requests that include directory traversal sequences such as ../, an attacker can redirect the uploaded file to arbitrary directories outside the intended upload directory. Since the service runs with elevated privileges typical of backup agents (often SYSTEM or root on Windows/Linux), the uploaded files are written with those same privileges.

The attack surface is the HTTP listener exposed by the UDP agent. In default configurations, this listener binds to network interfaces and may be reachable from the broader network, not just localhost. The unauthenticated nature of the vulnerability means no credentials, session tokens, or authentication bypass steps are required. An attacker simply needs network access to the agent's HTTP management port.

The NVD description does not provide additional technical detail regarding the exact request format, parameter names, or URL path used to access the vulnerable servlet. Insufficient technical detail is available to determine whether authentication bypass occurs at the servlet level or if the servlet was intended to be reachable without authentication.

Exploitation Scenarios

No public PoC or exploit code is available; the following attack chain is inferred from the vulnerability class and CNA description.

Step 1: Reconnaissance and Target Identification. An attacker begins by scanning for Arcserve UDP Agent installations across the internet or internal network. Shodan queries such as http.title:"Arcserve UDP" can identify exposed management interfaces. Port scanning for the agent's HTTP management port (commonly 8014 for UDP services, though this is not confirmed from the supplied data) can also identify targets. The attacker then fingerprints the version to confirm it is prior to 9.2.

Step 2: Triggering the Flaw. The attacker crafts an HTTP request to the vulnerable FileHandlingServlet endpoint targeting the doUpload() method. The request contains a file upload with a destination filename that includes path traversal sequences (e.g., ../../../../Windows/System32/evil.dll on Windows or ../../../../etc/cron.d/evil on Linux). The path traversal payload escapes the intended upload directory.

Step 3: Payload Delivery and Execution. The uploaded payload's nature determines the execution method. On Windows, an attacker could upload:

• A DLL into a startup directory or system directory for persistence
• An executable into a scheduled task folder
• A web shell into the web root if IIS or another web server is present
• A malicious script into a directory monitored by automated processes

On Linux, the attacker could upload:

• A cron job into /etc/cron.d/ for scheduled execution
• An SSH key into /root/.ssh/authorized_keys for persistent SSH access
• A library into directories loaded by privileged services

Since the service writes files with elevated privileges, the uploaded content is placed on disk with full permissions, enabling subsequent execution.

Step 4: Post-Exploitation. Once arbitrary file upload is achieved, the attacker typically establishes remote code execution by uploading executable content to appropriate directories and triggering its execution. This leads to full system compromise, enabling data exfiltration, ransomware deployment, lateral movement within the enterprise network, and destruction or encryption of backup data — a particularly damaging outcome given the victim runs a data protection product.

Impact Assessment

The CVSS score of 9.8 reflects a critical severity rating with full impact across confidentiality, integrity, and availability. The vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction needed.

Business Impact: This vulnerability affects backup infrastructure, which is a crown jewel in any enterprise environment. Compromise of the backup agent can lead to:

• Destruction or encryption of backups, severely impairing disaster recovery capability
• Ransomware operators frequently target backup systems first to prevent recovery
• Lateral movement into other critical systems using the compromised agent's credentials
• Persistent access to the enterprise environment

Affected Systems: All Arcserve UDP Agent installations prior to version 9.2. Arcserve UDP is deployed in mid-to-large enterprises and managed service providers for data protection. The agent is typically installed on the systems being backed up, meaning thousands of endpoints could be affected.

Blast Radius: Full remote code execution with SYSTEM-level privileges on the target host. The blast radius extends to the entire network due to potential lateral movement and becomes particularly severe in environments where backup agents are deployed across multiple interconnected systems.

Detection Guidance

Sigma Rule

title: Arcserve UDP Agent Path Traversal File Upload
id: 8cf49a6e-7bd3-4a62-9c15-11114c6dc3f0
status: experimental
description: Detects attempts to exploit CVE-2023-42000 - unauthenticated path traversal file upload in Arcserve UDP Agent FileHandlingServlet
author: Valters IT Security Team
date: 2024/01/15
logsource:
  category: webserver
  product: arcserve
detection:
  selection_request:
    cs-method: 'POST'
    cs-uri-path|contains: 'FileHandlingServlet'
  selection_traversal:
    cs-uri-query|contains:
      - '..%2f'
      - '..%5c'
      - '..%2F'
      - '..%5C'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
  selection_combination:
    c-uri-query|contains: 'doUpload'
  condition: selection_request and selection_traversal and selection_combination
falsepositives:
  - Legitimate file upload operations that may contain traversal sequences in filenames
level: critical

YARA Rule

rule ARCserve_UDP_PathTraversal_Upload {
    meta:
        author = "Valters IT Security Team"
        description = "Detects path traversal patterns targeting Arcserve UDP Agent FileHandlingServlet"
        reference = "CVE-2023-42000"
        date = "2024-01-15"
        severity = "critical"
    strings:
        $servlet = "FileHandlingServlet" ascii wide nocase
        $doUpload = "doUpload" ascii wide nocase
        $traversal1 = "..\\" ascii
        $traversal2 = "../" ascii
        $traversal3 = "%2e%2e%2f" ascii no wide
        $traversal4 = "%2e%2e%5c" ascii no wide
        $traversal5 = "..%2f" ascii no wide
        $traversal6 = "..%5c" ascii no wide
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A
        and $servlet
        and ($doUpload)
        and any of ($traversal*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-42000 Arcserve UDP Agent Path Traversal File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"FileHandlingServlet"; http.uri; content:"doUpload"; within:200; http.uri; content:".."; urilen:>20; classtype:attempted-admin; sid:202342000; rev:1; reference:cve,2023-42000; priority:1;)

Elastic Detection

network where event.category == "network" and event.outcome == "success" and
  destination.port in (80, 443, 8014) and
  network.protocol == "http" and
  http.request.method == "POST" and
  url.path contains "FileHandlingServlet" and
  (
    url.query contains "doUpload" or
    url.path contains "doUpload"
  ) and
  (
    url.path contains ".." or
    url.query contains ".." or
    request_body.content contains ".."
  )

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "%FileHandlingServlet%"
| where uri_path LIKE "%..%" OR query LIKE "%..%" OR form_data LIKE "%..%"
| where uri_path LIKE "%doUpload%"
| table _time, src_ip, dest_ip, uri_path, query, form_data, user_agent
| sort - _time

Wazuh OSSEC Rule

<rule id="100420" level="15">
  <decoded_as>json</decoded_as>
  <field name="url">\.*FileHandlingServlet\.*</field>
  <field name="method">POST</field>
  <regex>\.\.|%2e%2e</regex>
  <description>Arcserve UDP Agent path traversal file upload attempt (CVE-2023-42000)</description>
  <group>attack.attempt,attack.t1190,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate Mitigations:

• Isolate Arcserve UDP Agent management interfaces from untrusted networks using firewall rules or network segmentation
• Restrict access to the management HTTP port to only trusted administrative IP addresses
• Disable the file upload servlet if not actively required using configuration management
• Monitor network traffic to and from Arcserve UDP Agent hosts for suspicious file upload patterns
• Review existing systems for signs of prior compromise, including unexpected files in system directories

2. Patch/Upgrade Steps:

• Monitor Arcserve's official security advisories and release channels for an announced fix
• Upgrade to Arcserve UDP 9.2 or later once a patched version becomes available
• Test the upgrade in a staging environment before production rollout
• Validate the installation fingerprint using only official Arcserve binaries to avoid supply chain compromise

3. Long-Term Hardening:

• Deploy a web application firewall (WAF) in front of management interfaces with rules blocking path traversal payloads
• Apply the principle of least privilege to the Arcserve UDP Agent service account
• Enable comprehensive logging and alerting for the Arcserve UDP Agent management service
• Include Arcserve UDP Agent systems in vulnerability scanning and penetration testing programs
• Implement network-level detection for HTTP requests containing traversal sequences targeting backup infrastructure

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-42000
2. Arcserve Official Site (vendor advisory page): https://www.arcserve.com/support/security-advisories
3. MITRE ATT&CK Technique: https://attack.mitre.org/techniques/T1190/
4. EPSS Score Reference: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (not listed, verify periodically): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No exploit-in-the-wild evidence or associated threat actor campaigns have been publicly documented as of this report. The EPSS score of 0.01471 (71.3rd percentile) indicates moderate exploitation likelihood. Monitor CISA KEV and threat intelligence feeds regularly as exploitation may be discovered post-disclosure.