Horizon Alert
Summary of the vulnerability and why it matters
The Commvault Web Server has a vulnerability that can be exploited by an attacker who has already gained authenticated access. This flaw could allow an attacker to compromise the web server by creating and executing webshells. The business impact could include unauthorized access and control over the affected systems.
- Vulnerable: Commvault Web Server
- Flaw: Allows webshell creation and execution
- Impact: System compromise and unauthorized access
Attack Path
How an attacker could exploit the issue
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. This allows attackers to compromise web servers by creating and executing webshells. The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog.
- Exposed web server
- Authenticated attacker gains access
- Webshells are created and executed
Live Threat
Current exploitation, exposure, and threat context
A remote, authenticated attacker could exploit this vulnerability by creating and executing webshells, potentially leading to unauthorized access to sensitive data and systems. The threat actor could gain access to client secrets, including OAuth credentials, which can then be used to access Microsoft 365 environments. This could result in the compromise of downstream data in services like Exchange, SharePoint, Teams, and Dynamics 365. The attackers have been linked to a broader campaign targeting SaaS applications.
- Attackers likely have moderate skill.
- Requires authenticated access to the web server.
- High business risk; treat as urgent.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
A remote, authenticated attacker can exploit a vulnerability in the Commvault Web Server to compromise systems by creating and executing webshells. This could lead to unauthorized access and control of affected systems. Organizations using Commvault software should prioritize addressing this vulnerability to mitigate business risk.
- Find affected Commvault assets.
- Reduce exposure or isolate risk.
- Fix, verify, and monitor.
