CVE-2022-22396
📋 TL;DR
IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.9.3 write credentials in clear text to virgo log files during certain operations. This exposes remote vSnap, offload targets, or VADP credentials to anyone with log file access. Organizations using affected versions for backup operations are vulnerable.
💻 Affected Systems
- IBM Spectrum Protect Plus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to backup infrastructure, potentially compromising all backed-up data and using credentials to pivot to other systems.
Likely Case
Insiders or attackers with log access steal credentials to access backup targets, potentially exfiltrating or corrupting backup data.
If Mitigated
Limited credential exposure if logs are properly secured and monitored, but risk remains until patching.
🎯 Exploit Status
Exploitation requires access to log files, which typically needs some level of system access. No authentication bypass needed once logs are accessed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.1.10 and later
Vendor Advisory: https://www.ibm.com/support/pages/node/6591505
Restart Required: Yes
Instructions:
1. Download IBM Spectrum Protect Plus 10.1.10 or later from IBM Fix Central. 2. Backup current configuration. 3. Apply the update following IBM's installation guide. 4. Restart all Spectrum Protect Plus services.
🔧 Temporary Workarounds
Restrict log file access
linuxSet strict file permissions on virgo log files to prevent unauthorized access.
chmod 600 /path/to/virgo/logs/*.log
chown root:root /path/to/virgo/logs/*.log
Monitor log files for credential exposure
allImplement real-time monitoring of log files for credential patterns.
grep -i 'password\|credential\|key' /path/to/virgo/logs/*.log
🧯 If You Can't Patch
- Rotate all potentially exposed credentials immediately, especially for vSnap, offload targets, and VADP.
- Implement strict access controls and monitoring on all log file directories and consider moving logs to secured storage.
🔍 How to Verify
Check if Vulnerable:
Check version via Spectrum Protect Plus admin console or run 'java -jar /opt/IBM/SPP/version.jar' and verify if between 10.1.0.0 and 10.1.9.3.Check Version:
java -jar /opt/IBM/SPP/version.jarVerify Fix Applied:
After patching, verify version is 10.1.10 or later and test that credentials no longer appear in virgo logs during operations.📡 Detection & Monitoring
Log Indicators:
- Clear text passwords or credentials in virgo log files
- Patterns like 'password=', 'credential=', or specific credential strings in logs
Network Indicators:
- Unauthorized access attempts to log file directories or backup targets using potentially stolen credentials
SIEM Query:
source="*virgo*.log" AND ("password" OR "credential" OR "key") NOT "API key" NOT "certificate"