CVE-2024-22902

Executive Summary

CVE-2024-22902 exposes a critical security flaw in Vinchin Backup & Recovery v7.2, where the software is shipped with default root credentials. This vulnerability allows any unauthenticated attacker with network access to gain full administrative control over the backup infrastructure. The lack of a forced password change during initial setup or documented hardening guidance means that many deployments remain vulnerable. Given the sensitive nature of backup systems—which store copies of all organizational data—this flaw poses an extreme risk of data exfiltration, ransomware deployment, and lateral movement.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component is the only affected asset.
• Confidentiality Impact: High (C:H) – full access to backup data.
• Integrity Impact: High (I:H) – ability to modify or delete backups.
• Availability Impact: High (A:H) – can disrupt backup services.

Deep Dive & Mechanics

The vulnerability stems from Vinchin Backup & Recovery v7.2 being pre-configured with default root credentials (e.g., root:vinchin or similar). The software does not enforce a password change upon first login, nor does it provide any mechanism to detect or warn about default credentials. An attacker can simply SSH into the appliance or access the web management interface using these credentials.

Once authenticated as root, the attacker has unrestricted access to:

• All backup jobs and stored data.
• System configuration files.
• Network shares and connected storage.
• Ability to deploy ransomware or exfiltrate data.

The root cause is a classic CWE-798 (Use of Hard-coded Credentials) combined with a lack of secure-by-default configuration.

Vulnerable vs. Patched Code

Vulnerable (v7.2):

• Default credentials are set in /etc/vinchin/credentials.conf or similar.
• No password change enforcement on first login.
• No warning in the UI about default credentials.

Patched (Hypothetical):

• A forced password change on first login.
• Removal of hardcoded credentials from configuration files.
• Addition of a security banner warning about default credentials.

Since no official patch has been released, the only mitigation is manual password change.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Scan for Vinchin Backup & Recovery instances on ports 22 (SSH) or 443 (HTTPS).
2. Authentication: Attempt login with default credentials (e.g., root:vinchin).
3. Post-Exploitation: Once authenticated, dump backup data, modify backup jobs, or deploy ransomware.

Example SSH Login:

ssh root@<target_ip>
# Password: vinchin

Example Web Login:

curl -k -X POST https://<target_ip>/api/login -d "username=root&password=vinchin"

Blue Team

1. Detection: Monitor for failed login attempts followed by successful login with default usernames.
2. Honeypot: Deploy a decoy Vinchin instance to capture attacker behavior.
3. Network Segmentation: Isolate backup systems from general network access.

Indicators of Compromise (IOCs)

• Network: SSH or HTTPS connections to Vinchin servers from unexpected IPs.
• System: Presence of default credentials in /etc/vinchin/credentials.conf.
• Logs: Successful login events for root user without prior password change.
• File: Unauthorized access to backup archives or configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_22902_Vinchin_Default_Creds {
    meta:
        description = "Detects Vinchin Backup & Recovery default credential configuration"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22902"
    strings:
        $cred1 = "root:vinchin" ascii wide nocase
        $cred2 = "admin:vinchin" ascii wide nocase
        $cred3 = "backup:backup" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Vinchin Default Credential Login
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects successful login with default credentials on Vinchin Backup & Recovery
author: Valters IT
logsource:
    product: linux
    service: auth
detection:
    selection:
        EventID: 5580
        User: 'root'
        ProcessName: '/usr/sbin/sshd'
    condition: selection
falsepositives:
    - Legitimate admin password change not yet performed
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2024-22902 Vinchin Default SSH Login Attempt"; flow:to_server; content:"SSH-2.0-OpenSSH"; nocase; content:"root"; nocase; within:20; reference:cve,2024-22902; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Change the root password immediately using passwd command.
2. Configuration Hardening: Disable SSH password authentication and use SSH keys only.
3. Network Controls: Restrict access to the Vinchin management interface to trusted IPs only.
4. Monitoring: Enable logging and alerting for all administrative logins.
5. Vendor Contact: Reach out to Vinchin for an official patch or upgrade path.

Valters IT signature: This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of CVE-2024-22902 is illegal.