CVE-2020-16171 Explained : Impact and Mitigation

Acronis Cyber Backup before 12.5 Build 16342 is affected by a vulnerability that allows SSRF attacks through specific API endpoints.

Understanding CVE-2020-16171

This CVE identifies a security issue in Acronis Cyber Backup that could be exploited for SSRF attacks.

What is CVE-2020-16171?

An issue in Acronis Cyber Backup before version 12.5 Build 16342 allows attackers to abuse API endpoints to conduct SSRF attacks against localhost services.

The Impact of CVE-2020-16171

The vulnerability enables attackers to exploit the application to reach otherwise inaccessible Acronis services bound to localhost, potentially leading to unauthorized access.

Technical Details of CVE-2020-16171

Acronis Cyber Backup vulnerability specifics and affected systems.

Vulnerability Description

Vulnerability in Acronis Cyber Backup before 12.5 Build 16342
API endpoints on port 9877 accept a custom Shard header
Header value used in a separate web request, allowing SSRF attacks

Affected Systems and Versions

Product: Acronis Cyber Backup
Vendor: Acronis
Versions affected: All versions before 12.5 Build 16342

Exploitation Mechanism

Attackers abuse API endpoints on port 9877 under /api/ams/
Custom Shard header value utilized in a separate web request
Enables SSRF attacks against localhost-bound Acronis services

Mitigation and Prevention

Protecting systems from CVE-2020-16171.

Immediate Steps to Take

Update Acronis Cyber Backup to version 12.5 Build 16342
Monitor and restrict API access to prevent unauthorized requests

Long-Term Security Practices

Regularly review and update security configurations
Conduct security assessments to identify vulnerabilities

Patching and Updates

Apply patches and updates promptly to address known vulnerabilities