CVE-2023-48678 - Sensitive Information Disclosure in Acronis Cyber Protect 16 due to Insecure Folder Permissions

Attention Acronis Cyber Protect 16 users and administrators! A new vulnerability (CVE-2023-48678) has been discovered that can lead to sensitive information disclosure due to insecure folder permissions. This issue affects both Linux and Windows versions of Acronis Cyber Protect 16 before build 37391. In this long-read post, we'll dive deep into the vulnerability details, provide a code snippet to understand the issue better, and guide you on fixing it.

Affected Products

Acronis Cyber Protect 16 is an all-in-one protection solution that combines backups, disaster recovery, and cybersecurity to protect data, applications, and systems. The affected versions are:

The Vulnerability: CVE-2023-48678

This vulnerability occurs due to insecure folder permissions that can allow unauthorized users to access sensitive information. As a result, attackers can potentially exploit this vulnerability to gain access to backup data, configuration files, and other critical information present in the affected folders.

The Common Vulnerability Scoring System (CVSS) rates this vulnerability 3.3/10 in terms of severity. While it's not considered highly critical, organizations should not take this vulnerability lightly, as exploiting it can lead to the potential loss of sensitive data.

The official CVE (Common Vulnerabilities and Exposures) reference for this vulnerability is CVE-2023-48678.

Here's a code snippet that demonstrates the insecure folder permission issue

import os

# Create a directory with insecure folder permissions (0777)
os.makedirs("/path/to/insecure/folder", mode=o777)

# Save sensitive data to the insecure folder
with open("/path/to/insecure/folder/sensitive_data.txt", "w") as f:
    f.write("This is sensitive data that should be protected.")

In this example, the 'os.makedirs()' function creates a folder with permissions set to '0777', which allows any user to read, write, and execute files within it. Such permission settings expose sensitive data stored in the folder, which can be accessed by unauthorized users.

Exploit Details

An attacker who can gain access to a system running an affected version of Acronis Cyber Protect 16 (Linux or Windows) can exploit this vulnerability to access sensitive information stored in insecurely permissioned folders.

Read configuration files, which can expose internal system settings and network architecture.

3. Modify files or create new files within affected folders, which can lead to further security issues or even data loss.

Mitigation and Solutions

To address CVE-2023-48678, Acronis has released an update. Users and administrators of Acronis Cyber Protect 16 are advised to update their software to the latest build 37391 or newer. More information about updates and downloads can be found on the Acronis website.

In addition to updating your software, consider the following best practices for securing your system:

- Always limit folder permissions to the required minimum. For sensitive information, restrict access to only authorized users.
- Regularly review and audit folder permissions across your systems, especially for folders containing sensitive information.
- Educate your users about the importance of securing data and following best practices for managing folder permissions.
- Implement effective monitoring tools to detect unauthorized access or suspicious activity on your systems.

Stay informed about the latest vulnerabilities and security updates. Protect your organization and system assets by addressing potential risks and implementing robust security measures. Don't let sensitive information fall into the wrong hands due to insecure folder permissions.

Timeline

Published on: 02/27/2024 17:15:10 UTC
Last modified on: 02/28/2024 14:07:00 UTC