A crucial safety flaw has been disclosed within the Commvault Command Middle that would permit arbitrary code execution on affected installations.
The vulnerability, tracked as CVE-2025-34028, carries a CVSS rating of 9.0 out of a most of 10.0.
“A crucial safety vulnerability has been recognized within the Command Middle set up, permitting distant attackers to execute arbitrary code with out authentication,” Commvault mentioned in an advisory printed on April 17, 2025. “This vulnerability may lead to an entire compromise of the Command Middle surroundings.”
It impacts the 11.38 Innovation Launch, from variations 11.38.0 via 11.38.19, and has been resolved within the following variations –
watchTowr Labs researcher Sonny Macdonald, who has been credited with discovering and reporting the flaw on April 7, 2025, mentioned in a report shared with The Hacker Information that it may very well be exploited to realize pre-authenticated distant code execution.
Particularly, the problem is rooted in an endpoint known as “deployWebpackage.do,” triggering what’s known as a pre-authenticated Server-Facet Request Forgery (SSRF) owing to the truth that there may be “no filtering as to what hosts will be communicated with.”
To make issues worse, the SSRF flaw might then be escalated to realize code execution by making use of a ZIP archive file containing a malicious .JSP file. The whole sequence of occasions is as follows –
- Ship an HTTP request to /commandcenter/deployWebpackage.do, inflicting the Commvault occasion to retrieve a ZIP file from an exterior server
- Contents of the ZIP file get unzipped right into a .tmp listing underneath the attacker’s management
- Use the servicePack parameter to traverse the .tmp listing right into a pre-authenticated dealing with listing on the server, akin to ../../Reviews/MetricsUpload/shell
- Execute the SSRF by way of /commandcenter/deployWebpackage.do
- Execute the shell from /reviews/MetricsUpload/shell/.tmp/dist-cc/dist-cc/shell.jsp
watchTowr has additionally created a Detection Artefact Generator that organizations can use to find out if their occasion is susceptible to the vulnerability.
With vulnerabilities in backup and replication software program like Veeam and NAKIVO coming underneath lively exploitation within the wild, it is important that customers apply crucial mitigations to safeguard in opposition to potential threats.
