CVE-2021-27877

HIGHCISA KEVRansomwareNuclei

Veritas Backup Exec Agent Improper Authentication Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-27877 has a selected CVSS score of 8.2 (high); EIP currently links 1 catalogued exploit, 1 repository PoC, and 1 Nuclei template. CISA lists CVE-2021-27877 in KEV and reports its use in known ransomware campaigns.

Description

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Apr 7, 2023 · CISA
VulnCheck KEV
Listed · Apr 3, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · CISA

Available material

Catalogued exploits
1
Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationActive
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 22, 2023 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Backup Exec Agent

Browse Veritas / Backup Exec Agent
CISAVersion data not supplied

Proofs of concept

2

Catalogued exploits

MetasploitVeritas Backup Exec Agent Remote Code ExecutionMetasploit exploitby Alexander Korotin <0xc0rs@gmail.com>Not analyzed1 file

Ruby · linked to 3 vulnerabilities

Metasploit
PoC details

Repository PoCs

GitHubyashswarup12/CVE-2021-27877-PoCRepository PoCby yashswarup120Exploit2 files

20.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A modified Metasploit module that exploits CVE-2021-27877 in Veritas Backup Exec Agent by authenticating via the deprecated SHA scheme and executing an arbitrary OS command supplied by the user.

Backdoor review

No backdoor observed in reviewed code

The repository contains a modified Metasploit module for CVE-2021-27877 and a README. The module executes a user-supplied OS command via the vulnerable NDMP service. No concealed backdoor, unrelated payload, persistence, or credential theft is present. The code is a straightforward PoC for the stated vulnerability.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesRuby
Target softwareVeritas Backup Exec Agent
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a modified Metasploit module that performs the full exploit chain: connection, TLS negotiation, SHA authentication bypass, and execution of an arbitrary OS command via NDMP_EXECUTE_COMMAND. It is designed to exercise the vulnerability, not merely detect it.

README.md:3-7beagent_sha_auth_rce_custom.rb:96-116beagent_sha_auth_rce_custom.rb:80-94

Requirements

  • Target must be running a vulnerable Veritas Backup Exec Agent (versions up to 21.2) with SHA authentication enabled.README.md:3beagent_sha_auth_rce_custom.rb:23-30
  • Attacker must have network connectivity to the target's NDMP service (default port 10000).README.md:58-59beagent_sha_auth_rce_custom.rb:58-59

Observed behavior

  • Connects to the target NDMP service, negotiates TLS, authenticates using the SHA scheme with a crafted hash, and sends an NDMP_EXECUTE_COMMAND request containing the user-supplied OS command.beagent_sha_auth_rce_custom.rb:96-116beagent_sha_auth_rce_custom.rb:80-94beagent_sha_auth_rce_custom.rb:220-251
  • Executes the command on the target host with SYSTEM or root privileges, but does not return output directly; the user must arrange an out-of-band callback (e.g., HTTP POST) to retrieve results.README.md:72-74README.md:61beagent_sha_auth_rce_custom.rb:26-27
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
Payload withheldThis is the core PoC functionality; it is transparently documented and not hidden.beagent_sha_auth_rce_custom.rb:75beagent_sha_auth_rce_custom.rb:108-112
Authentication Bypass
Payload withheldThis is the exploit mechanism for the CVE; it is part of the normal exploit behavior.beagent_sha_auth_rce_custom.rb:220-251
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two text files provided; no runtime logs or network captures are included.
  • The artifact is a modification of an existing Metasploit module; the original module's full context is not supplied.
  • Only the two text files (README.md and beagent_sha_auth_rce_custom.rb) were reviewed; no other files exist in the repository.
  • The review does not assess whether the exploit works as claimed or is safe to run against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryHIGHVeritas Backup Exec - Broken AuthenticationCVSS 8.2

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes- SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

Impact

Unauthenticated attackers can exploit the deprecated SHA authentication scheme to bypass authentication and gain unauthorized access to Backup Exec Agents, potentially executing privileged commands and compromising backup systems.

Remediation

Upgrade to Veritas Backup Exec version 21.2 or later that disables the insecure SHA authentication scheme.

Authorspussycat0x, DhiyaneshDK
Template tagscvecve2021networkjstcppassivekevvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CPE: cpe:2.3:a:veritas:backup_exec:*:*:*:*:*:*:*:*
Shodan: product:"Veritas Backup Exec"
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb

Source: ProjectDiscovery

References

4