Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability in Comet Backup allows any tenant administrator to impersonate any end-user from another tenant on the same server. This means one administrator could access or control accounts belonging to users in entirely different organizations using the software.
- Tenant administrators can access other tenants' data.
- A wide range of users could be affected.
- The issue is reachable from the internet.
Attack Path
How an attacker could exploit the issue
An attacker could abuse this IDOR vulnerability by impersonating any end-user account on a Comet Backup server. This allows them to access or manipulate data belonging to other tenants that they would not normally have access to.
- Vulnerable API call exploited.
- Requires tenant administrator access.
- Affects shared Comet Backup servers.
Live Threat
Current exploitation, exposure, and threat context
Attackers will likely target this critical IDOR vulnerability because it allows for tenant impersonation via an API, which is a common and effective attack vector. The vulnerability impacts all versions and provides direct access to sensitive user data.
- Public exploit code is not yet observed.
- Comet Backup has known internet-facing deployments.
- The vulnerability allows for privilege escalation.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate investigation for any signs of unauthorized access or administrative impersonation within your Comet Backup environment, given the critical IDOR vulnerability. Focus on identifying and isolating potentially compromised tenant administrator accounts, and review all API call logs for suspicious activity.
- Block API endpoints used in attack.
- Monitor for unusual tenant administrator activity.
- Update Comet Backup to a patched version.
