Security advisory: Pre-authentication RCE in AOMEI Cyber Backup v2.3.0 (AOMEI)
disclosure via Fulldisclosure ·
0day Rubbish Research Team is publicly disclosing a vulnerability in AOMEI Cyber Backup v2.3.0 (AOMEI). The research is published and a proof-of-concept is available. Pre-authentication RCE (CVSS 9.8, pre-authentication) AOMEI Cyber Backup v2.3.0 runs as root in a Docker container and exposes four Thrift binary-protocol ports, but only the 9072 Gateway enforces JWT authentication. The three internal Thrift ports (9074, 9077, 9078) bind to the container network with no authentication handler. An attacker who can reach ports 9074 and 9078 persists an injected NAS credential via AddBackupStorageNAS, then triggers DeleteBackupStorage, whose async lambda builds a CIFS mount command via system() with unescaped username and password fields. A single-quote escape in the username field injects an arbitrary shell command that executes as root (uid=0). The chain requires only network reachability to the internal Thrift ports; no credentials and no user interaction are required. Impact: Arbitrary command execution as root (uid=0) inside the backup infrastructure container; the attacker can read backup metadata and stored credentials, alter backup storage records, and disrupt or destroy backup operations. Advisory: https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/