CVE-2021-32579
📋 TL;DR
This vulnerability allows an unauthenticated attacker with local code execution capability to tamper with the micro-service API in Acronis True Image backup software. This affects Windows users running versions prior to 2021 Update 4 and macOS users running versions prior to 2021 Update 5. The vulnerability enables API manipulation that could lead to further system compromise.
💻 Affected Systems
- Acronis True Image
📦 What is this software?
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through privilege escalation, data theft, or ransomware deployment via manipulated backup processes.
Likely Case
Local privilege escalation allowing attacker to execute arbitrary code with higher privileges than initially obtained.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are enforced, restricting lateral movement.
🎯 Exploit Status
Exploitation requires local access first, but once obtained, the API tampering is unauthenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Windows: 2021 Update 4 or later; macOS: 2021 Update 5 or later
Vendor Advisory: https://kb.acronis.com/content/68413
Restart Required: Yes
Instructions:
1. Open Acronis True Image. 2. Click 'Check for updates' in the main interface. 3. Follow prompts to install the latest update. 4. Restart the system when prompted.
🔧 Temporary Workarounds
Disable Acronis True Image Service
allTemporarily disable the vulnerable micro-service until patching can be completed.
Windows: sc stop "Acronis True Image Service"
macOS: sudo launchctl unload /Library/LaunchDaemons/com.acronis.trueimage.plist
🧯 If You Can't Patch
- Implement strict application whitelisting to prevent unauthorized local code execution.
- Apply network segmentation to isolate systems running vulnerable versions from critical assets.
🔍 How to Verify
Check if Vulnerable:
Check Acronis True Image version in application settings or About dialog.Check Version:
Windows: Check Help > About in Acronis True Image; macOS: Open Acronis True Image > About Acronis True ImageVerify Fix Applied:
Verify version is Windows: 2021 Update 4 (build 39287) or later, macOS: 2021 Update 5 (build 39287) or later.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to Acronis micro-services
- Suspicious process creation from Acronis executables
Network Indicators:
- Unexpected network connections from Acronis processes to unusual destinations
SIEM Query:
process_name:"Acronis*" AND (event_type:"process_creation" OR event_type:"network_connection")