CVE-2017-17412
📋 TL;DR
CVE-2017-17412 is a critical SQL injection vulnerability in Quest NetVault Backup that allows unauthenticated remote attackers to execute arbitrary SQL commands. This can lead to remote code execution on the underlying database server. All systems running vulnerable versions of Quest NetVault Backup are affected.
💻 Affected Systems
- Quest NetVault Backup
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the database server and potentially pivoting to other systems in the network.
Likely Case
Data exfiltration, database corruption, or installation of backdoors/malware on the database server.
If Mitigated
Attack blocked at network perimeter; no impact if proper input validation and SQL parameterization are implemented.
🎯 Exploit Status
ZDI published exploit details and proof-of-concept. The vulnerability is trivial to exploit due to lack of input validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.3.0.13 or later
Vendor Advisory: https://support.quest.com/netvault-backup/kb/293038/netvault-backup-security-vulnerability-notification-cve-2017-17412
Restart Required: Yes
Instructions:
1. Download the latest patch from Quest support portal. 2. Stop NetVault Backup services. 3. Apply the patch. 4. Restart services. 5. Verify version is 11.3.0.13 or higher.
🔧 Temporary Workarounds
Network Segmentation
allBlock external access to NetVault Backup web interface (default port 20031)
iptables -A INPUT -p tcp --dport 20031 -j DROP
netsh advfirewall firewall add rule name="Block NetVault" dir=in action=block protocol=TCP localport=20031
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Immediately restrict network access to only trusted IP addresses
- Implement database-level controls: use least privilege accounts, enable SQL Server audit logging
🔍 How to Verify
Check if Vulnerable:
Check NetVault Backup version in web interface or installation directory. Version 11.3.0.12 is vulnerable.Check Version:
On Windows: Check HKLM\SOFTWARE\Quest\NetVault\Version. On Linux: cat /opt/quest/netvault/version.txtVerify Fix Applied:
Verify version is 11.3.0.13 or higher. Test SQL injection attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL syntax in web logs
- GET requests with SQL keywords in parameters
Network Indicators:
- Unusual outbound connections from database server
- SQL commands in HTTP GET requests to port 20031
SIEM Query:
source="netvault.log" AND ("SELECT" OR "UNION" OR "INSERT" OR "DELETE") AND status=200