CVE-2024-48248
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4Description
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
Analysis
NAKIVO Backup & Replication contains an absolute path traversal allowing unauthenticated remote attackers to read arbitrary files, including configuration files with cleartext credentials for physical discovery operations.
Technical Context
The CWE-36 path traversal via the getImageByPath parameter in /c/router allows reading any file on the NAKIVO server. The PhysicalDiscovery configuration contains cleartext credentials for vCenter, Hyper-V, and other infrastructure, enabling cascade compromise.
Affected Products
['NAKIVO Backup & Replication before 11.0.0.88174']
Remediation
Update NAKIVO immediately. Rotate all infrastructure credentials stored in NAKIVO (vCenter, Hyper-V, cloud accounts). Restrict network access to the NAKIVO management interface.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today