CVE-2023-25544
📋 TL;DR
Dell NetWorker versions 19.5 and earlier expose Apache Tomcat version information, allowing attackers to fingerprint the software. This vulnerability affects users with remote access to NetWorker clients, potentially enabling targeted attacks based on known vulnerabilities in specific Tomcat versions.
💻 Affected Systems
- Dell NetWorker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers use version information to launch targeted exploits against known vulnerabilities in the exposed Apache Tomcat version, potentially leading to remote code execution or data exfiltration.
Likely Case
Attackers gather intelligence about the system to plan targeted attacks, increasing the success rate of subsequent exploitation attempts.
If Mitigated
Limited information disclosure with no direct exploitation path, though it still provides reconnaissance value to attackers.
🎯 Exploit Status
Exploitation requires prior access and additional steps to leverage version information for attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to NetWorker version 19.6 or later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000210471/dsa-2023-058-dell-networker-security-update-for-version-disclosure-vulnerability
Restart Required: Yes
Instructions:
1. Download the latest NetWorker update from Dell support. 2. Apply the patch following Dell's installation guide. 3. Restart NetWorker services to apply changes.
🔧 Temporary Workarounds
Restrict Access to NetWorker Clients
allLimit network access to NetWorker clients to trusted IPs only.
Use firewall rules to restrict inbound connections to NetWorker ports (e.g., iptables for Linux, Windows Firewall for Windows).
Disable Version Headers in Tomcat
allConfigure Apache Tomcat to suppress version information in HTTP headers.
Modify Tomcat's server.xml to set server="" or a generic value in the Connector configuration.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate NetWorker clients from untrusted networks.
- Monitor for unusual access patterns or reconnaissance attempts targeting NetWorker systems.
🔍 How to Verify
Check if Vulnerable:
Check NetWorker version via administrative interface or command line; if version is 19.5 or earlier, it is vulnerable.Check Version:
On NetWorker server, run 'nsr_version' command or check via NetWorker Management Console.Verify Fix Applied:
Confirm NetWorker version is 19.6 or later after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to NetWorker endpoints, especially those probing for version information.
Network Indicators:
- Traffic to NetWorker ports (default 9000-9001) from unauthorized sources.
SIEM Query:
source="NetWorker" AND (event="version_disclosure" OR http_user_agent CONTAINS "scanner")