CVE-2020-16171 : An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/

An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct SSRF attacks against otherwise unreachable Acronis services that are bound to localhost such as the NotificationService on 127.0.0.1:30572.

Published 2020-09-21 14:15:13

Updated 2020-10-01 15:43:16

Source MITRE

View at NVD, CVE.org

Vulnerability category: Server-side request forgery (SSRF)

Exploit prediction scoring system (EPSS) score for CVE-2020-16171

EPSS FAQ

5.63%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-16171

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:P/A:N	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2020-16171

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-16171

http://seclists.org/fulldisclosure/2020/Sep/33

Full Disclosure: [CVE-2020-16171] Acronis Cyber Backup <= v12.5 Build 16341 Full Unauthenticated SSRF
Exploit;Mailing List;Third Party Advisory
https://www.rcesecurity.com/2020/09/CVE-2020-16171-Exploiting-Acronis-Cyber-Backup-for-Fun-and-Emails/

CVE-2020-16171: Exploiting Acronis Cyber Backup for Fun and Emails - RCE Security
Third Party Advisory

Products affected by CVE-2020-16171

Acronis » Cyber Backup
Versions up to, including, (<=) 12.5
cpe:2.3:a:acronis:cyber_backup:*:*:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5
cpe:2.3:a:acronis:cyber_backup:12.5:-:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 10130
cpe:2.3:a:acronis:cyber_backup:12.5:10130:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 10330
cpe:2.3:a:acronis:cyber_backup:12.5:10330:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 11010
cpe:2.3:a:acronis:cyber_backup:12.5:11010:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 13160
cpe:2.3:a:acronis:cyber_backup:12.5:13160:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 13400
cpe:2.3:a:acronis:cyber_backup:12.5:13400:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 14280
cpe:2.3:a:acronis:cyber_backup:12.5:14280:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 14330
cpe:2.3:a:acronis:cyber_backup:12.5:14330:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 16180
cpe:2.3:a:acronis:cyber_backup:12.5:16180:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 16318
cpe:2.3:a:acronis:cyber_backup:12.5:16318:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 16327
cpe:2.3:a:acronis:cyber_backup:12.5:16327:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 7641
cpe:2.3:a:acronis:cyber_backup:12.5:7641:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 7970
cpe:2.3:a:acronis:cyber_backup:12.5:7970:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 8850
cpe:2.3:a:acronis:cyber_backup:12.5:8850:*:*:*:*:*:*
Matching versions
Acronis » Cyber Backup » Version: 12.5 Update 9010
cpe:2.3:a:acronis:cyber_backup:12.5:9010:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-16171

Exploit prediction scoring system (EPSS) score for CVE-2020-16171

CVSS scores for CVE-2020-16171

CWE ids for CVE-2020-16171

References for CVE-2020-16171

Products affected by CVE-2020-16171