CVE-2021-27876

HIGHCISA KEVRansomware

Veritas Backup Exec Agent File Access Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-27876 has a selected CVSS score of 8.1 (high); EIP currently links 1 catalogued exploit and 1 repository PoC. CISA lists CVE-2021-27876 in KEV and reports its use in known ransomware campaigns.

Description

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Apr 7, 2023 · CISA
VulnCheck KEV
Listed · Apr 3, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · CISA

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 22, 2023 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Backup Exec Agent

Browse Veritas / Backup Exec Agent
CISAVersion data not supplied

Proofs of concept

2

Catalogued exploits

MetasploitVeritas Backup Exec Agent Remote Code ExecutionMetasploit exploitby Alexander Korotin <0xc0rs@gmail.com>Not analyzed1 file

Ruby · linked to 3 vulnerabilities

Metasploit
PoC details

Repository PoCs

GitHubwingerbijay/CVE-2021-27876Repository PoCby wingerbijay1Exploit3 files

15.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878 in Veritas Backup Exec Agent to achieve unauthenticated remote code execution as SYSTEM. It performs a custom TLS handshake, bypasses SHA authentication, and executes arbitrary OS commands via the NDMP protocol.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script (be_rce.py) for CVE-2021-27876/77/78 targeting Veritas Backup Exec Agent. The script performs a documented authentication bypass and remote command execution against the stated target. No concealed backdoor, unrelated payload, persistence mechanism, or deceptive behavior was observed. The code's actions are consistent with the described exploit chain.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareVeritas Backup Exec Agent
Attack typesauthentication bypassremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Python script that actively exploits vulnerabilities to gain unauthorized access and execute arbitrary commands on a remote system. It performs a TLS handshake, bypasses authentication, and runs OS commands, which constitutes exploitation, not just detection or scanning.

be_rce.py:1-9be_rce.py:157-297

Requirements

  • Network access to the target Veritas Backup Exec Agent on TCP/10000.be_rce.py:22-23
  • Python 3.8+ with the 'cryptography' library installed.README.md:41-49

Observed behavior

  • Connects to the target on port 10000 and performs a custom TLS handshake by generating a CA, requesting the agent's CSR, signing it, and upgrading the socket to TLS.be_rce.py:157-223
  • Bypasses SHA authentication by computing SHA256('\x00' * 64 + challenge) and authenticating as 'Administrator' without a password.be_rce.py:225-241
  • Executes an arbitrary OS command via NDMP_EXECUTE_COMMAND, redirecting output to a temporary file, then reads the file back over the NDMP connection.be_rce.py:243-293
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the normal, documented exploit behavior for the stated CVEs.be_rce.py:157-297
File Cleanup
Payload withheldThis is standard operational cleanup, not a backdoor.be_rce.py:281-283
Review boundaries

What the analysis did not establish

  • One file (total 3) was omitted from the text evidence; its content is unknown.
  • The evidence was not executed; classification is based solely on static analysis of the provided source code.
  • One file in the repository (metadata only, not text) was not inspected; its content is unknown but flagged as non-text and unlikely to contain executable backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4