CVE-2024-48248
NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
Description
CVE-2024-48248 is a high-severity absolute path traversal vulnerability in NAKIVO Backup & Replication before version 11.0.0.88174 that allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability exists in the getImageByPath function accessible via the /c/router endpoint, where an attacker can specify absolute file paths to access any file readable by the application process. This is particularly dangerous because NAKIVO's PhysicalDiscovery component stores cleartext credentials, meaning file read access can escalate to remote code execution across the enterprise. With a CVSS v3.1 score of 8.6 and an EPSS score of 93.97% at the 99.9th percentile, CISA has confirmed active exploitation by adding CVE-2024-48248 to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| nakivo | backup \& replication director | < 11.0.0.88174 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm(Product)
- https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/(Third Party Advisory)
- https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248(US Government Resource)
Weakness Type
CWE-36: Absolute Path Traversal
CVE-2024-48248 is classified under CWE-36 (Absolute Path Traversal), a vulnerability where software accepts user input containing absolute file paths without validating that the specified path is within an authorized directory. Unlike relative path traversal that uses "../" sequences, absolute path traversal allows attackers to directly specify complete filesystem paths such as "/etc/passwd," bypassing any base directory restrictions. In NAKIVO Backup & Replication, the getImageByPath endpoint accepts absolute paths that are used directly for file operations without authorization checks.
Learn more: CWE-36 — Absolute Path Traversal
Impact Analysis
CVE-2024-48248 has severe impact due to the critical role of backup infrastructure in enterprise environments. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) or user interaction (UI:N), and has Changed scope (S:C), meaning the impact extends beyond the NAKIVO application itself. Confidentiality (High) is critically compromised because attackers can read any file on the server, including NAKIVO's PhysicalDiscovery configuration that stores cleartext credentials for managed infrastructure — including hypervisor passwords, cloud provider API keys, and storage system credentials. These harvested credentials enable lateral movement and remote code execution across the entire enterprise infrastructure managed by NAKIVO. The EPSS score of 93.97% at the 99.9th percentile places this among the top 0.1% of vulnerabilities most likely to be exploited, reflecting the high value of backup systems as targets for ransomware operators and advanced threat actors who seek to disable recovery capabilities before encrypting production systems.
Exploit Maturity
CVE-2024-48248 demonstrates very high exploit maturity. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 9, 2025. Public proof-of-concept exploit code is available via the watchTowr Labs GitHub repository, and detailed technical analysis is published in the watchTowr Labs blog. The EPSS score of 93.97% at the 99.9th percentile places this vulnerability in the top 0.1% for exploitation probability. Backup systems are prime targets for ransomware groups seeking to destroy recovery capabilities, and the availability of cleartext credentials through this vulnerability makes it an especially attractive initial access vector.
Remediation
-
Upgrade NAKIVO Backup & Replication to version 11.0.0.88174 or later immediately. Review the NAKIVO release notes for upgrade instructions and compatibility guidance.
-
Rotate all credentials stored in or managed by the NAKIVO instance, including hypervisor passwords, cloud provider credentials, storage system accounts, and any other infrastructure credentials configured in PhysicalDiscovery. Assume all credentials are compromised if the instance was exposed while running a vulnerable version.
-
Restrict network access to the NAKIVO /c/router endpoint and the management web interface. Place the backup management interface behind a VPN or IP-restricted access controls to prevent direct exposure to untrusted networks.
-
Conduct forensic investigation on any NAKIVO instances running versions before 11.0.0.88174 that were accessible from untrusted networks. Review web server access logs for requests to the /c/router endpoint with getImageByPath parameters containing absolute paths. Check for signs of credential harvesting and lateral movement in managed infrastructure.
-
Implement network segmentation between backup infrastructure and production systems as a long-term hardening measure. Backup management interfaces should only be accessible from dedicated management networks, and credential storage should use encryption at rest with proper key management rather than cleartext storage.
Technical Details
CVE-2024-48248 is an absolute path traversal vulnerability in NAKIVO Backup & Replication versions before 11.0.0.88174. The vulnerability exists in the getImageByPath function, which is accessible via unauthenticated HTTP requests to the /c/router endpoint. When a request is made to this endpoint with a file path parameter, the application uses the supplied path directly for file read operations without validating that the path falls within an authorized directory. An attacker can specify absolute paths like "/etc/passwd" or paths to NAKIVO's internal configuration files to read any file accessible to the application process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N reflects that the attack is unauthenticated, network-accessible, and has Changed scope because reading NAKIVO's PhysicalDiscovery cleartext credentials enables attacking systems beyond NAKIVO itself, effectively escalating from file read to enterprise-wide compromise.
Frequently Asked Questions
Is CVE-2024-48248 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2024-48248 and public proof-of-concept exploit code is available on GitHub. The EPSS score of 93.97% at the 99.9th percentile indicates this is among the most actively targeted vulnerabilities currently tracked.
What products are affected by CVE-2024-48248?
NAKIVO Backup & Replication Director versions before 11.0.0.88174 are affected. The vulnerability is in the /c/router endpoint's getImageByPath functionality.
How do I fix CVE-2024-48248?
Upgrade to NAKIVO Backup & Replication version 11.0.0.88174 or later. After upgrading, rotate all credentials managed by the NAKIVO instance, as the cleartext credential storage means any exposed instance may have had its managed infrastructure credentials harvested.
How severe is CVE-2024-48248?
CVE-2024-48248 is rated High with a CVSS score of 8.6 and Changed scope. While the direct impact is file reading, the presence of cleartext credentials in NAKIVO's configuration means that this vulnerability can escalate to remote code execution across an organization's entire managed infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.