CVE-2023-42000
📋 TL;DR
Arcserve UDP versions before 9.2 contain a path traversal vulnerability in the FileHandlingServlet that allows unauthenticated remote attackers to upload arbitrary files to any location on the file system where the UDP agent is installed. This affects all systems running vulnerable Arcserve UDP versions with the agent exposed to network access.
💻 Affected Systems
- Arcserve Unified Data Protection
📦 What is this software?
Udp by Arcserve
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution by uploading malicious files to critical system directories, potentially leading to ransomware deployment, data theft, or persistent backdoors.
Likely Case
Attackers upload web shells or malware to gain initial foothold, then escalate privileges to compromise the backup server and potentially connected systems.
If Mitigated
Limited impact if network segmentation prevents external access, but internal attackers could still exploit to compromise the backup system.
🎯 Exploit Status
Tenable published technical details and proof-of-concept. The vulnerability requires no authentication and has simple exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2 or later
Vendor Advisory: https://support.arcserve.com/s/article/000021333
Restart Required: Yes
Instructions:
1. Download Arcserve UDP 9.2 or later from official portal. 2. Backup current configuration. 3. Run installer with administrative privileges. 4. Restart services after installation completes.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to UDP agent ports (8014/TCP by default) to only trusted management systems.
Windows: netsh advfirewall firewall add rule name="Block UDP Agent" dir=in action=block protocol=TCP localport=8014 remoteip=any
Linux: iptables -A INPUT -p tcp --dport 8014 -j DROP
Web Application Firewall
allDeploy WAF with path traversal protection rules to block malicious upload requests.
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can communicate with UDP agent ports
- Deploy file integrity monitoring on critical system directories to detect unauthorized file uploads
🔍 How to Verify
Check if Vulnerable:
Check Arcserve UDP version via web console or installation directory. Versions below 9.2 are vulnerable.Check Version:
Windows: reg query "HKLM\SOFTWARE\Arcserve\Unified Data Protection" /v Version | Linux: cat /opt/arcserve/udp/version.txtVerify Fix Applied:
Verify version is 9.2 or higher and test that path traversal attempts to upload files outside permitted directories are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /UDPAgent/FileHandlingServlet with ../ sequences in parameters
- File creation events in system directories from Arcserve process
- Unusual file upload patterns to UDP agent
Network Indicators:
- HTTP traffic to UDP agent port (8014) containing path traversal sequences
- Multiple file upload attempts from single source
SIEM Query:
source="arcserve.log" AND (uri_path="/UDPAgent/FileHandlingServlet" AND (param="../" OR param="..\\"))