Unitrends UEB 9 HTTP API/Storage Remote Root Exploit

It was discovered that the api/storage web interface in Unitrends Backup UB before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system. Th...

Unitrends UEB bpserverd Authentication Bypass / Remote Command Execution Exploit

It was discovered that the api/storage web interface in Unitrends Backup UB before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system. Th...

Unitrends UEB 9 HTTP API/Storage Remote Root

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Unitrends UEB 9 http api/storage remote root', 'Description' = %q It was discovered that the api/storage web interface in Unitrends Backup UB...

Unitrends UEB bpserverd Authentication Bypass / Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Unitrends UEB bpserverd authentication bypass RCE', 'Description' = %q It was discovered that the Unitrends bpserverd proprietary protocol, as...

Unitrends Enterprise Backup 7.3.0 Multiple Vulnerabilities

Multiple vulnerabilities in Unitrends Enterprise Backup version 7.3.0. Authentication bypass and remote code execution RCE. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Unitrends UEB bpserverd authentication bypass RCE

It was discovered that the Unitrends bpserverd proprietary protocol, as exposed via xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system. This module requires Metasploit:...

Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution Exploit

Exploit for linux platform in category remote exploits Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Cale Smith, Benny Husted, Jared Arave Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendo...

Unitrends UEB 9.1 - Privilege Escalation Exploit

Exploit for php platform in category web applications Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1 Exploit Authors: Benny Husted, Jared Arave, Cale Smith Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage:...

Unitrends UEB 9.1 - Unitrends bpserverd Remote Command Execution Exploit

Exploit for linux platform in category remote exploits Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Jared Arave, Cale Smith, Benny Husted Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendo...

Unitrends UEB 9.1 bpserverd Remote Command Execution

Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Jared Arave, Cale Smith, Benny Husted Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...

Unitrends UEB 9.1 Authentication Bypass / Remote Command Execution

Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Cale Smith, Benny Husted, Jared Arave Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...

Unitrends UEB 9.1 Privilege Escalation

Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Benny Husted, Jared Arave, Cale Smith Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...

The vulnerability of the bpserverd protocol used by Unitrends Backup software allows a perpetrator to bypass authentication procedures or execute arbitrary commands with root privileges.

The vulnerability of the bpserverd protocol used by Unitrends Backup software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process or execute arbitrary commands with root privileges, using the xinetd...

The vulnerability in the web interface of the API/Storage component of the Unitrends Backup tool allows a perpetrator to bypass authentication procedures or execute arbitrary commands with root privileges.

The vulnerability in the web interface of the Unitrends Backup backup tool’s storage component is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process or execute arbitrary commands with root privileges...

Unitrends Backup License Issue Vulnerability

Unitrends Backup UB is a set of data protection software from the American company Unitrends. The software provides data backup, data recovery and deduplication functions. A security vulnerability exists in the bpserverd proprietary protocol in versions of UB prior to 10.0.0. A remote attacker ca...

Unitrends Backup Privilege Access Control Vulnerability

Unitrends Backup UB is a set of data protection software from the American company Unitrends. The software provides data backup, data recovery and deduplication functions. A security vulnerability exists in session logic in versions of UB prior to 10.0.0. A remote attacker can exploit this...

Unitrends Backup Authorization Issues Vulnerability (CNVD-2017-28329)

Unitrends Backup UB is a set of data protection software from the American company Unitrends. The software provides data backup, data recovery and deduplication functions. A security vulnerability exists in the api/storage web interface in versions of UB prior to 10.0.0, which stems from the...

Unitrends UEB 9.1 - Authentication Bypass Remote Command Execution

Unitrends UEB 9.1 - Authentication Bypass Remote Command Execution Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Cale Smith, Benny Husted, Jared Arave Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted ||...

Unitrends UEB 9.1 - Privilege Escalation

Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Benny Husted, Jared Arave, Cale Smith Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...

Unitrends UEB 9.1 - 'Unitrends bpserverd' Remote Command Execution

Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Jared Arave, Cale Smith, Benny Husted Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...