CVE-2017-17652
📋 TL;DR
CVE-2017-17652 is a critical SQL injection vulnerability in Quest NetVault Backup that allows unauthenticated remote attackers to execute arbitrary SQL commands. This can lead to remote code execution on the underlying database server. All installations of Quest NetVault Backup 11.3.0.12 are affected.
💻 Affected Systems
- Quest NetVault Backup
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the database server leading to data theft, destruction, or ransomware deployment across connected systems.
Likely Case
Database compromise allowing data exfiltration, privilege escalation, and lateral movement within the network.
If Mitigated
Limited impact if database runs with minimal privileges and network segmentation prevents lateral movement.
🎯 Exploit Status
ZDI published detailed advisory with exploitation details. Attack requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.3.0.13 or later
Vendor Advisory: https://support.quest.com/netvault-backup/kb/293038/netvault-backup-security-vulnerabilities
Restart Required: Yes
Instructions:
1. Download latest version from Quest support portal. 2. Backup configuration. 3. Run installer. 4. Restart NetVault Backup services.
🔧 Temporary Workarounds
Network Segmentation
allBlock external access to NetVault Backup ports (typically TCP 20031-20034)
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port protocol="tcp" port="20031-20034" reject'
netsh advfirewall firewall add rule name="Block NetVault" dir=in action=block protocol=TCP localport=20031-20034
🧯 If You Can't Patch
- Implement strict network ACLs to allow only trusted IPs to access NetVault Backup services
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check NetVault Backup version in web interface or installation directory. Version 11.3.0.12 is vulnerable.Check Version:
On Windows: reg query "HKLM\SOFTWARE\Quest\NetVault Backup" /v Version. On Linux: cat /opt/quest/netvault/version.txtVerify Fix Applied:
Verify version is 11.3.0.13 or higher. Test SQL injection payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts followed by SQL errors
- Requests to /NVBUBackup.asmx with SQL-like parameters
Network Indicators:
- Unusual traffic to TCP ports 20031-20034 from external IPs
- SQL error messages in HTTP responses
SIEM Query:
source="netvault.log" AND ("SQL" OR "syntax" OR "NVBUBackup") AND status=500