CVE-2021-27876
Veritas Backup Exec Agent File Access Vulnerability
Description
CVE-2021-27876 is an authentication bypass and arbitrary file access vulnerability in Veritas Backup Exec before version 21.2. The vulnerability exists in the SHA Authentication scheme used for communication between clients and Backup Exec Agents, allowing an attacker to bypass authentication and gain unauthorized access. Once authenticated, the attacker can exploit crafted input parameters in data management protocol commands to read arbitrary files on the system with System-level privileges. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been associated with ransomware campaigns, making it a high-priority security concern for organizations running Veritas Backup Exec.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| veritas | backup exec | < 21.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.veritas.com/content/support/en_US/security/VTS21-001#issue2(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27876(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2021-27876 by NVD. However, the vulnerability involves an authentication bypass in the SHA Authentication scheme of Veritas Backup Exec, which allows unauthorized access to the Agent and subsequent arbitrary file read operations with elevated privileges. The root cause lies in insufficient validation within the legacy authentication mechanism.
Impact Analysis
CVE-2021-27876 carries a CVSS v3.1 score of 8.1 (High) and poses a significant risk to organizations using Veritas Backup Exec. The vulnerability is remotely exploitable over the network with low attack complexity, meaning no special conditions are required to mount an attack. While low-level privileges are required to initiate the exploit, no user interaction is needed, allowing automated exploitation. Confidentiality (High): A successful exploit grants the attacker the ability to read arbitrary files on the target system using System privileges, potentially exposing sensitive backup data, credentials, and configuration files. Integrity (High): The attacker can also leverage the authenticated connection to execute data management commands that could modify or corrupt backup data. This vulnerability has been confirmed as actively exploited in ransomware campaigns, which means threat actors are using it to exfiltrate data before deploying ransomware payloads, significantly increasing the business impact.
Exploit Maturity
Public exploit code is available for CVE-2021-27876 via Packet Storm Security, providing attackers with a ready-to-use proof-of-concept for remote code execution on Veritas Backup Exec Agents. CISA has confirmed active exploitation of this vulnerability in the wild, and it is known to be used in ransomware campaigns, underscoring the urgency of remediation. With an EPSS score of 0.99% (76th percentile), exploitation probability is moderate but the confirmed real-world exploitation and ransomware association make this a critical priority. CVE-2021-27876 is frequently chained with related Veritas Backup Exec vulnerabilities CVE-2021-27877 and CVE-2021-27878, which together provide a complete attack path from authentication bypass to arbitrary command execution.
Remediation
- Apply vendor mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The CISA remediation deadline was April 28, 2023.
- Upgrade Veritas Backup Exec to version 21.2 or later, which addresses the SHA Authentication scheme vulnerability. Refer to the Veritas security advisory VTS21-001 for detailed upgrade instructions.
- Restrict network access to Backup Exec Agent ports by implementing firewall rules and network segmentation to ensure only authorized backup servers can communicate with Agents. Block external access to the Agent communication ports entirely.
- Review Backup Exec Agent logs for signs of unauthorized authentication attempts or unusual data management protocol commands. Check for indicators of compromise including unexpected file access patterns and connections from unknown IP addresses.
- Disable the legacy SHA Authentication scheme if your Backup Exec version supports it, forcing all agent-client communication to use stronger authentication methods. Ensure TLS is properly configured and enforced for all backup communications.
Technical Details
The CVE-2021-27876 vulnerability resides in the SHA Authentication scheme used by Veritas Backup Exec for client-to-Agent communication. While communication between clients and Agents typically occurs over a secure TLS channel, a flaw in the SHA Authentication implementation allows an attacker to complete the authentication handshake without proper credentials. As indicated by the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the attack is network-based with low complexity, requiring only low-level privileges and no user interaction. Once the attacker has established an authenticated session, they can issue data management protocol commands with crafted input parameters that enable arbitrary file access on the target system running with System privileges. The scope remains unchanged, meaning the impact is confined to the Backup Exec Agent component, but the high confidentiality and integrity impact ratings reflect the attacker's ability to both read and potentially manipulate files through the compromised Agent connection.
Frequently Asked Questions
Is CVE-2021-27876 being actively exploited?
Yes, CVE-2021-27876 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog, and it is confirmed to be used in ransomware campaigns. Organizations running Veritas Backup Exec versions prior to 21.2 should treat this as a critical priority.
What products are affected by CVE-2021-27876?
CVE-2021-27876 affects Veritas Backup Exec Agent in all versions prior to 21.2. The vulnerability specifically targets the SHA Authentication scheme used for client-Agent communication, impacting any deployment that has not been updated to version 21.2 or later.
How do I fix CVE-2021-27876?
The primary remediation is to upgrade Veritas Backup Exec to version 21.2 or later. Additionally, restrict network access to Backup Exec Agent communication ports and disable the legacy SHA Authentication scheme if possible. See the Remediation section for detailed steps.
How severe is CVE-2021-27876?
CVE-2021-27876 is rated High severity with a CVSS v3.1 score of 8.1. It sits in the 76th EPSS percentile for exploitation probability. The confirmed use in ransomware campaigns and the availability of public exploit code make it a high-priority vulnerability despite the moderate EPSS score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.