CVE-2024-48248
📋 TL;DR
CVE-2024-48248 is an absolute path traversal vulnerability in NAKIVO Backup & Replication that allows unauthenticated attackers to read arbitrary files via the /c/router endpoint. This can lead to credential theft and potentially remote code execution across enterprise environments. Organizations using affected NAKIVO Backup & Replication versions are vulnerable.
💻 Affected Systems
- NAKIVO Backup & Replication
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain cleartext credentials from PhysicalDiscovery files, pivot to other systems, and achieve full enterprise compromise with remote code execution.
Likely Case
Attackers steal backup credentials, access sensitive backup data, and potentially compromise backup infrastructure.
If Mitigated
File read limited to accessible files without credential exposure, minimal data leakage.
🎯 Exploit Status
Public proof-of-concept available on GitHub. CISA has added to Known Exploited Vulnerabilities catalog indicating active exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.0.88174 and later
Vendor Advisory: https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm
Restart Required: Yes
Instructions:
1. Download NAKIVO Backup & Replication version 11.0.0.88174 or later from official vendor site. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the NAKIVO Backup & Replication service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to NAKIVO web interface to trusted networks only
Web Application Firewall Rules
allBlock requests to /c/router endpoint and filter path traversal patterns
🧯 If You Can't Patch
- Isolate NAKIVO Backup & Replication server from other critical systems and internet
- Implement strict network access controls and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check if version is below 11.0.0.88174 via web interface or installation directory. Test with PoC: curl -k 'https://target:4443/c/router?action=getImageByPath&path=/etc/passwd'Check Version:
Check web interface login page or installation directory for version informationVerify Fix Applied:
Verify version is 11.0.0.88174 or higher. Test that the PoC no longer returns arbitrary files.📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /c/router endpoint
- GET parameters with 'action=getImageByPath' and 'path=' containing directory traversal sequences
Network Indicators:
- Unusual file read patterns from backup server
- Requests to sensitive file paths from untrusted sources
SIEM Query:
source="nakivo" AND uri_path="/c/router" AND query_string="*action=getImageByPath*"🔗 References
- https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm
- https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/
- https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248
