CVE-2025-30413

Executive Summary

CVE-2025-30413 is a security vulnerability in Acronis Cyber Protect Cloud Agent and Acronis Cyber Protect 17 that fails to delete stored credentials after a protection plan is revoked. This flaw allows a local attacker with low privileges to access sensitive credentials that should have been removed, potentially leading to lateral movement or privilege escalation within the compromised environment. The vulnerability affects all supported platforms (Linux, macOS, Windows) and has a CVSS score of 4.4 (Medium). No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects a proprietary commercial software product (Acronis Cyber Protect). The risk is primarily to enterprise environments using Acronis for backup and endpoint protection.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs some level of access (e.g., a standard user account).
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): Low (L) – Limited credential exposure.
• Integrity (I): Low (L) – Potential for credential misuse.
• Availability (A): Low (L) – Potential for service disruption via credential abuse.

Threat Level: Medium. While the CVSS score is moderate, the potential for credential theft and lateral movement makes this a significant concern for organizations using Acronis.

Deep Dive & Mechanics

The vulnerability resides in the credential management subsystem of the Acronis Agent. When a protection plan (e.g., backup, antivirus) is revoked or removed, the associated credentials (e.g., storage account keys, service account passwords) are not properly purged from the agent's local credential store. This is likely due to a missing cleanup routine in the plan revocation logic.

Root Cause Analysis:

1. Plan Revocation: The agent receives a command to revoke a protection plan.
2. Credential Retention: The code removes the plan configuration but fails to iterate through and delete the associated credentials from the secure storage (e.g., Windows Credential Manager, macOS Keychain, Linux keyring or file-based store).
3. Persistence: The credentials remain on disk or in memory, accessible to any process running under the same user context or with sufficient local privileges.

Attack Scenario:

1. An attacker gains initial access to a system (e.g., via phishing, weak password).
2. The attacker enumerates local credential stores and discovers leftover Acronis credentials.
3. The attacker uses these credentials to access cloud storage, other systems, or escalate privileges within the network.

Vulnerable vs. Patched Code

Since the source code is proprietary, we can infer the fix based on the vulnerability description.

Vulnerable Code (Conceptual):

def revoke_plan(plan_id):
    # Remove plan configuration
    config.remove_plan(plan_id)
    # BUG: Credentials are not deleted
    # credentials.delete_for_plan(plan_id)  # This line is missing

Patched Code (Conceptual):

def revoke_plan(plan_id):
    # Remove plan configuration
    config.remove_plan(plan_id)
    # FIX: Delete associated credentials
    credentials.delete_for_plan(plan_id)

The patch adds a call to delete credentials when a plan is revoked.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Local access to a system running a vulnerable Acronis Agent (build < 40497 or < 41186).
• A user account with standard privileges.

Steps:

1. Identify Acronis Agent: Check for running processes or installed software.

   # Linux
   ps aux | grep acronis
   # Windows
   tasklist | findstr acronis
   

2. Locate Credential Store: The location varies by OS.
   • Windows: %APPDATA%\Acronis\BackupAndRecovery\Credentials or Windows Credential Manager.
   • Linux: ~/.local/share/acronis/credentials or keyring.
   • macOS: Keychain entries under "Acronis".
3. Extract Credentials: Use built-in tools or scripts to dump the credential store.

   # Linux example (if stored in plaintext or reversible format)
   cat ~/.local/share/acronis/credentials/*.json
   # Windows example (using PowerShell to access Credential Manager)
   powershell -Command "Get-StoredCredential -Target Acronis* | Select-Object UserName, Password"
   

4. Use Credentials: Leverage the extracted credentials for lateral movement or data access.

Blue Team (Defensive)

Detection:

• Monitor for unusual access to Acronis credential files.
• Alert on processes reading credential store files outside of normal Acronis operations.
• Use file integrity monitoring (FIM) on credential directories.

Hunting:

• Search for credential files that persist after plan revocation.
• Review logs for plan revocation events and subsequent credential access.

Lab Setup:

1. Install a vulnerable version of Acronis Cyber Protect (e.g., build 40000).
2. Configure a protection plan with credentials (e.g., cloud storage account).
3. Revoke the plan.
4. Verify that credentials remain accessible.

Indicators of Compromise (IOCs)

• File Paths:
  • Windows: %APPDATA%\Acronis\BackupAndRecovery\Credentials\*
  • Linux: ~/.local/share/acronis/credentials/*
  • macOS: Keychain entries with "Acronis" in the name.
• Registry Keys (Windows):
  • HKCU\Software\Acronis\BackupAndRecovery\Credentials
• Process Names:
  • acronis_agent.exe (Windows)
  • acronis-agent (Linux/macOS)
• Network Connections:
  • Outbound connections to Acronis cloud services (e.g., *.acronis.com) after plan revocation (may indicate credential misuse).

Detection Engineering

YARA Rule

rule CVE_2025_30413_Acronis_Credentials {
    meta:
        description = "Detects leftover Acronis credential files after plan revocation"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-30413"
    strings:
        $cred_file = "Acronis" nocase
        $cred_ext = ".json" nocase
        $cred_key = "password" nocase
    condition:
        $cred_file and $cred_ext and $cred_key
}

Sigma Rule

title: Acronis Credential Persistence After Plan Revocation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects access to Acronis credential files after a plan revocation event
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'Acronis\BackupAndRecovery\Credentials'
    condition: selection
falsepositives:
    - Legitimate Acronis operations
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-30413 - Potential Acronis Credential Exfiltration";
    flow:to_server,established;
    content:"Acronis"; nocase;
    content:"password"; nocase;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Acronis Software: Update to the latest patched versions:
   • Acronis Cyber Protect Cloud Agent: build 40497 or later.
   • Acronis Cyber Protect 17: build 41186 or later.
2. Credential Rotation: Immediately rotate any credentials that were stored in Acronis before the patch was applied.
3. Manual Cleanup: If patching is delayed, manually delete credential stores after plan revocation:
   • Windows: Delete files in %APPDATA%\Acronis\BackupAndRecovery\Credentials\.
   • Linux: Delete files in ~/.local/share/acronis/credentials/.
   • macOS: Delete keychain entries.

Long-Term Mitigations:

• Implement least privilege for local users.
• Use endpoint detection and response (EDR) to monitor credential access.
• Enforce multi-factor authentication (MFA) for all accounts.
• Regularly audit credential stores for stale or orphaned entries.

Workarounds:

• If patching is not possible, consider disabling the credential caching feature (if configurable) or using a separate, isolated account for Acronis operations.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert