CVE-2018-11143
📋 TL;DR
CVE-2018-11143 is a command injection vulnerability in Quest DR Series Disk Backup software that allows attackers to execute arbitrary commands on affected systems. This affects organizations using Quest DR Series Disk Backup software versions before 4.0.3.1, potentially leading to complete system compromise.
💻 Affected Systems
- Quest DR Series Disk Backup software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, data exfiltration, ransomware deployment, and lateral movement across the network.
Likely Case
Unauthenticated remote code execution leading to backup data theft, system disruption, and potential credential harvesting.
If Mitigated
Limited impact if network segmentation and proper access controls prevent exploitation attempts.
🎯 Exploit Status
Multiple public exploit details and proof-of-concept code are available. The vulnerability is easily exploitable with publicly available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.3.1 and later
Vendor Advisory: https://support.quest.com/dr-series/kb/311640/quest-dr-series-disk-backup-software-security-vulnerabilities-notification
Restart Required: Yes
Instructions:
1. Download Quest DR Series Disk Backup software version 4.0.3.1 or later from official Quest channels. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the system and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Quest DR Series systems from untrusted networks and limit access to authorized management IPs only.
Use firewall rules to restrict access to Quest DR Series management interfaces
Access Control
allImplement strict network access controls and authentication requirements for management interfaces.
Configure network ACLs to allow only trusted IP addresses to access the backup system
🧯 If You Can't Patch
- Immediately isolate affected systems from all networks, especially internet-facing connections
- Implement strict network segmentation and monitor for any exploitation attempts or anomalous activity
🔍 How to Verify
Check if Vulnerable:
Check the software version in the Quest DR Series management interface or via command line: 'drcli version' or similar vendor-specific commands.Check Version:
drcli version (or check via Quest DR Series web interface)Verify Fix Applied:
Verify the installed version is 4.0.3.1 or later and test that command injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Unexpected process creation from Quest DR Series services
- Failed authentication attempts followed by command execution
Network Indicators:
- Unexpected outbound connections from backup systems
- Traffic to/from Quest DR Series management ports from unauthorized sources
SIEM Query:
source="quest_dr_series" AND (event_type="command_execution" OR process_name="cmd.exe" OR process_name="/bin/sh")🔗 References
- http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html
- http://seclists.org/fulldisclosure/2018/May/71
- https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
- http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html
- http://seclists.org/fulldisclosure/2018/May/71
- https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
