CVE-2022-36954
📋 TL;DR
In Veritas NetBackup OpsCenter, an authenticated remote attacker can create or modify user accounts under specific conditions. This vulnerability affects OpsCenter versions 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and version 10.
💻 Affected Systems
- Veritas NetBackup OpsCenter
📦 What is this software?
Netbackup by Veritas
Netbackup by Veritas
Netbackup by Veritas
⚠️ Risk & Real-World Impact
Worst Case
An attacker could create administrative accounts, gain full control of the OpsCenter system, and potentially compromise the entire NetBackup environment.
Likely Case
Attackers with existing authenticated access could escalate privileges, create backdoor accounts, or modify existing user permissions.
If Mitigated
With proper network segmentation and access controls, impact is limited to the OpsCenter component only.
🎯 Exploit Status
Requires authenticated access but specific conditions are not publicly detailed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.0.3, 9.0.0.2, 9.1.0.2, and 10.0.0.1
Vendor Advisory: https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue1
Restart Required: Yes
Instructions:
1. Download appropriate patch from Veritas support portal. 2. Apply patch following Veritas documentation. 3. Restart OpsCenter services.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to OpsCenter web interface and API to trusted networks only
Access Control
allImplement strict authentication and authorization controls for OpsCenter access
🧯 If You Can't Patch
- Isolate OpsCenter systems from untrusted networks
- Implement multi-factor authentication and monitor for suspicious account creation
🔍 How to Verify
Check if Vulnerable:
Check OpsCenter version via web interface or command lineCheck Version:
On OpsCenter server: cat /etc/version or check web interfaceVerify Fix Applied:
Verify version is updated to patched version and test user account creation/modification📡 Detection & Monitoring
Log Indicators:
- Unexpected user account creation/modification events in OpsCenter logs
- Authentication attempts from unusual sources
Network Indicators:
- Unusual API calls to user management endpoints
- Traffic to OpsCenter from unauthorized sources
SIEM Query:
source="opscenter" AND (event="user_create" OR event="user_modify")