[FD] Security advisory: Pre-authentication RCE in AOMEI Cyber Backup v2.3.0 (AOMEI)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in AOMEI 
Cyber Backup v2.3.0 (AOMEI). The research is published and a proof-of-concept 
is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

AOMEI Cyber Backup v2.3.0 runs as root in a Docker container and exposes four 
Thrift binary-protocol ports, but only the 9072 Gateway enforces JWT 
authentication. The three internal Thrift ports (9074, 9077, 9078) bind to the 
container network with no authentication handler. An attacker who can reach 
ports 9074 and 9078 persists an injected NAS credential via 
AddBackupStorageNAS, then triggers DeleteBackupStorage, whose async lambda 
builds a CIFS mount command via system() with unescaped username and password 
fields. A single-quote escape in the username field injects an arbitrary shell 
command that executes as root (uid=0). The chain requires only network 
reachability to the internal Thrift ports; no credentials and no user 
interaction are required.

Impact: Arbitrary command execution as root (uid=0) inside the backup 
infrastructure container; the attacker can read backup metadata and stored 
credentials, alter backup storage records, and disrupt or destroy backup 
operations.

Advisory: https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/