Acronis: Acronis True Image Local Privilege Escalation via insecure folder permissions

Note: This has been submitted via service desk earlier, and I got a call from Acronis customer service that it's up on H1 and I should submit it there as well. All of the Acronis LaunchDaemons except the price helper which can be found here: /Library/LaunchDaemons/com.acronis. start an app / scri...

Acronis: Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swf

Hello there, I hope you are well! Steps: 1. Open firefox. 2. Go to http://www.grouplogic.com/jwplayer/player.swf?playerready=alertdocument.domain You will see xss alert. Impact Reflected XSS Regards, @mygf...

Acronis: Reflected XSS on www.grouplogic.com/video.asp

Hello there, I hope you are well! PoC: http://www.grouplogic.com/video.asp?v=Acroxx1%22%3C/script%3E%3Cscript%3Ealertdocument.cookie%3C/script%3EsaE&e=mp4&width=560&height=315 Impact Stealing cookies Best Regards, @mygf...

Acronis: Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.asp

Hello there, I hope you are well! As I see, Group Logic is your subsidary and www.grouplogic.com is a managed website by Acronis. F803772 I found a reflected xss on http://www.grouplogic.com/ PoC:...

Acronis: anti_ransomware_service.exe REST API does not require authentication

antiransomwareservice.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the Acronis True Image 2020 GUI to the antiransomwareservice.exe. This can be exploited to add an arbitary malicious executable to the whitelist or even exclude...

Acronis: Denial of Service in anti_ransomware_service.exe via logs files

antiransomwareservice.exe keeps a log in a folder where any unprivileged user has write permissions. The logs are generated in a predictable pattern allowing the unprivileged user to create a hardlink from the, not yet created, log file to the antiransomwareservice itself. On reboot, this forces...

Acronis: Local Privilege Escalation in anti_ransomware_service.exe via quarantine

antiransomwareservice.exe includes a functionality to quarantine files which will copy the suspected ransomware file from one directory to another using SYSTEM privileges. As any unprivileged user has write permissions in the quarantine folder, it is possible to control this privileged write with...

Acronis: Open redirect at mc-beta-cloud-acronis.com

Open Redirect Vulnerability Steps To Reproduce: Type in this URL:...

Acronis: Broken Access Controls

The End Point notary.acronis.com Blocks access to the panel if you are not an authenticated user. More is possible to access some functions of the panel by adding the .html at the end See Poc From Video Below Impact Broken access control vulnerabilities exist when a user can in fact access some...

Acronis: Missing rate limit for current password field (Password Change) Account Takeover

Vulnerability: Missing Rate Limit for Current Password field Password Change Account Takeover Steps to reproduce the bug: 1Go to Profile Password. Enter any wrong password In current password filed. 2Now enter the new password and Turn the Intercept ON. 3Capture the request & Send the request to...

Acronis: Accessing repository and other files by directory listing

It was reported that directory listing is possible on https://storage-repo.acronis.com. https://storage-repo.acronis.com is a YUM repository with no sensitive data and it is supposed to be publicly accessible...

Acronis True Image OEM 19.0.5128 - (afcdpsrv) Unquoted Service Path Vulnerability

Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software: ftp://supportdownload:email protected/AcronisTrueImageOEM5128.exe Version: 19.0.5128 Tested on: Windows 10 Description: Acronis True Imag...

Acronis True Image OEM 19.0.5128 - afcdpsrv Unquoted Service Path

Acronis True Image OEM 19.0.5128 - afcdpsrv Unquoted Service Path Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Date: 2019-11-11 Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software:...

Acronis True Image OEM 19.0.5128 Unquoted Service Path

Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Date: 2019-11-11 Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software: ftp://supportdownload:[email protected]/AcronisTrueImageOEM5128.exe Version: 19.0.5128 Tested on: Windows...

Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path

Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Date: 2019-11-11 Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software: ftp://supportdownload:[email protected]/AcronisTrueImageOEM5128.exe Version: 19.0.5128 Tested on: Windows...

Acronis: Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)

The vulnerability allowed an attacker to delete any user's added email, telephone, fax, address, and Skype via CSRF in a GET method without any CSRF protection on the Academy Acronis website. This could be exploited by an attacker to delete sensitive information of any user. The issue was fixed b...

Product update: Virtuozzo Infrastructure Platform 3.0 Update 1.1 (3.0.1-59)

This update provides stability fixes. Vulnerability id: VSTOR-25491 ABGW Acronis Backup Gateway could reject Acronis Backup Advanced certificates. Vulnerability id: VSTOR-25625 S3 NS services could fail to start...

Acronis: Blind XSS on admin.acronis.com via delete account form on account.acronis.com

Blind XSS vulnerability was discovered on admin.acronis.com. The vulnerability could be triggered by sending a payload during the account deletion process on account.acronis.com...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 1 (2.5.0-1599)

This update provides stability and usability fixes. Vulnerability id: VSTOR-19695, VSTOR-19857 Improved automatic firewall rules configuration. Vulnerability id: VSTOR-19909 Unable to register Backup Gateway in Acronis Backup Advanced with an IP address...

Product release: Virtuozzo Infrastructure Platform 2.5

This product is formerly known as Virtuozzo Storage. With this release, Virtuozzo Infrastructure Platform offers a wide range of new features for compute virtualization and software-defined networking, as well as enhancements and stability improvements. It also addresses issues found in the...