Huntress Details R1Soft CVE-2022-36537 Exploit Chain Enabling Root RCE
Summary
Huntress researchers chained CVE-2022-36537’s ZK authentication bypass in R1Soft Server Backup Manager SE to root-level RCE and code execution on managed agents. A Feb. 2023 update, citing Fox-IT and SecurityWeek, reports exploitation on hundreds of servers.
Key points
- The ZK framework authentication bypass, CVE-2022-36537, was present in ConnectWise R1Soft Server Backup Manager SE.
- Huntress reproduced the bypass, accessed sensitive server files, and used a backdoored JDBC driver to gain code execution as root.
- The proof of concept used the REST API to run commands on registered agents and demonstrated the ability to push LockBit 3.0 ransomware downstream.
- Huntress identified about 5,000 exposed server-manager instances via Shodan; those instances and their registered hosts were potentially at risk.
- ConnectWise released a patch; R1Soft instances were directed to upgrade to SBM 6.16.4. Huntress said its testing confirmed the patch stopped its proof of concept.
- At the time of the original report, Huntress and ConnectWise had found no evidence of in-the-wild exploitation. A February 2023 update, citing Fox-IT and SecurityWeek, said the vulnerability had since been exploited to deploy backdoors on hundreds of servers.
Article Details
- Attack Vectors
- The ZK authentication bypass in R1Soft Server Backup Manager SE could be used to access sensitive server files and gain administrative access.
- The proof of concept uploaded a backdoored JDBC driver, added it to the server’s class path, and invoked it to achieve code execution as root.
- The proof of concept used the REST API to send commands and arbitrary code to registered agents and downstream hosts.
- The article’s February 2023 update reports that CVE-2022-36537 was exploited in the wild to deploy backdoors on hundreds of servers; it does not identify the threat actors.
- Defensive Notes
- Upgrade R1Soft Server Backup Manager to SBM v6.16.4; the article says Huntress validated that this patch stops its proof of concept.
- The article says ConnectWise Recover SBMs were automatically updated to version 2.9.9.
- Review /usr/sbin/r1soft/log/server.log for database-driver uploads, commands sent to agents, and Java exceptions. The article notes that executed commands are not logged.
- Review C:\Program Files\Server Backup Agent\log\cdp.log for commands received from the server, but treat this cautiously because the activity may be normal.
- If proxy request logging is available, investigate repeated POST requests to /zkau/upload and use of a nextURI query parameter. The article notes that HTTP request logging is not enabled by default on the Server Backup Manager SE server.
MITRE ATT&CK
T1005 · Data from Local SystemUsing the authentication bypass and resulting access, the researchers retrieved server files including configuration files, logs, credential keystores, and private keys.T1072 · Software Deployment ToolsThe proof of concept used Server Backup Manager’s registered-agent functionality to send commands and arbitrary code to downstream hosts.T1105 · Ingress Tool TransferThe proof of concept uploaded a backdoored JDBC database-driver JAR to the server.T1129 · Shared ModulesThe uploaded JDBC driver was added to the class path and invoked to execute code on the server.T1190 · Exploit Public-Facing ApplicationThe proof of concept exploited the ZK authentication bypass in the remotely accessible R1Soft Server Backup Manager SE.
CVE
People
Airman604Credited by the researchers for an online primitive for a backdoored JDBC driver used in their proof of concept.Caleb StewartHuntress security researcher who helped recreate the proof of concept and investigate its impact.Florian HauserAttempted to notify ConnectWise about the vulnerability and shared screenshots demonstrating the authentication bypass.Jason SlagleHelped coordinate communication and connect Huntress researchers with ConnectWise.John HammondHuntress security researcher who helped recreate the proof of concept and investigate its impact.Markus WulftangeDiscovered the ZK authentication bypass vulnerability and participated in responsible disclosure.
Malware
Vendors
Products
Tools
BurpsuiteThe screenshots that @frycos shared online displayed different HTTP requests and responses present in Burpsuite, which was not as telling as a full writeup and detailed explanation.ShodanOur research identified upwards of 5,000 exposed server manager backup instances via Shodan—all of which had the potential to be exploited by threat actors, along with their registered hosts.
Industries
hostingConsidering that Server Backup Manager SE is predominately used by Hosting and Managed Service Providers who specialize in outsourced IT services for many businesses, this vulnerability has the potential to impactManaged service providersConsidering that Server Backup Manager SE is predominately used by Hosting and Managed Service Providers who specialize in outsourced IT services for many businesses, this vulnerability has the potential to impact