CVE-2024-22900
📋 TL;DR
Vinchin Backup & Recovery v7.2 contains an authenticated remote code execution vulnerability in the setNetworkCardInfo function. This allows authenticated attackers to execute arbitrary commands on the server with the privileges of the application. Organizations using Vinchin Backup & Recovery v7.2 are affected.
💻 Affected Systems
- Vinchin Backup & Recovery
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, steal backup data, deploy ransomware, or pivot to other systems in the network.
Likely Case
Data exfiltration of backup archives, deployment of cryptocurrency miners, or installation of persistent backdoors.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and minimal privileges for backup service accounts.
🎯 Exploit Status
Exploit code is publicly available on Packet Storm Security and other sources. Attack requires valid credentials but is straightforward to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v7.2 Update 1 or later
Vendor Advisory: http://vinchin.com
Restart Required: Yes
Instructions:
1. Log into Vinchin Backup & Recovery web interface. 2. Navigate to System Settings > Update. 3. Check for available updates. 4. Apply v7.2 Update 1 or later. 5. Restart the backup service or entire system as prompted.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Vinchin Backup & Recovery web interface to only trusted administrative networks.
Authentication Hardening
allImplement multi-factor authentication, strong password policies, and limit administrative accounts.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Vinchin web interface
- Monitor for unusual command execution patterns and review authentication logs for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if running Vinchin Backup & Recovery v7.2 without Update 1 applied. Log into web interface and check version in System Settings.Check Version:
curl -k https://<vinchin-ip>:8080/api/version or check web interface System SettingsVerify Fix Applied:
Verify version shows v7.2 Update 1 or later in System Settings > About.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to setNetworkCardInfo endpoint
- Command execution patterns in system logs
- Failed authentication attempts followed by successful login
Network Indicators:
- Unusual outbound connections from backup server
- Traffic to command and control servers
- Unexpected network scanning from backup server
SIEM Query:
source="vinchin.log" AND (uri="/api/setNetworkCardInfo" OR command="cmd.exe" OR command="/bin/sh")🔗 References
- http://vinchin.com
- https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/
- https://seclists.org/fulldisclosure/2024/Jan/29
- http://packetstormsecurity.com/files/176788/Vinchin-Backup-And-Recovery-7.2-setNetworkCardInfo-Command-Injection.html
- http://seclists.org/fulldisclosure/2024/Jan/26
- http://vinchin.com
- https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/
- https://seclists.org/fulldisclosure/2024/Jan/29
