CVE-2021-27878: Veritas Backup Exec Auth Bypass Flaw

CVE-2021-27878 Overview

CVE-2021-27878 is an authentication bypass vulnerability in Veritas Backup Exec that allows remote attackers to gain unauthorized access to the backup agent through a flaw in the SHA Authentication scheme. Once authenticated, attackers can leverage data management protocol commands to execute arbitrary commands with system privileges, resulting in complete system compromise.

Critical Impact

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can achieve remote code execution with system privileges on vulnerable Veritas Backup Exec installations.

Affected Products

• Veritas Backup Exec versions prior to 21.2
• Veritas Backup Exec Agent components
• Systems running vulnerable Backup Exec client-agent communication

Discovery Timeline

• 2021-03-01 - CVE-2021-27878 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-27878

Vulnerability Analysis

The vulnerability resides in the authentication mechanism between Veritas Backup Exec clients and agents. While the communication is typically secured over TLS, a critical flaw exists in the SHA Authentication scheme implementation. This weakness allows an attacker to bypass the authentication process entirely and establish an authenticated connection without valid credentials.

Once an attacker successfully bypasses authentication, they gain access to the full suite of data management protocol commands. Among these commands is functionality that permits execution of arbitrary system commands. Because the Backup Exec Agent typically runs with elevated privileges to perform backup and restore operations, any commands executed through this vector inherit system-level privileges.

The attack can be performed remotely over the network without requiring any user interaction, making it particularly dangerous for organizations with exposed Backup Exec agents.

Root Cause

The root cause stems from improper implementation of the SHA Authentication scheme used during the client-to-agent authentication handshake. The authentication logic fails to properly validate authentication tokens or responses, allowing attackers to craft requests that satisfy the authentication checks without possessing legitimate credentials.

Attack Vector

The attack proceeds through the following stages:

1. Network Discovery: The attacker identifies systems running Veritas Backup Exec Agent services, typically listening on network ports used for backup communications.

2. Authentication Bypass: The attacker exploits the SHA Authentication scheme vulnerability to complete the authentication process without valid credentials.

3. Command Execution: With an authenticated session established, the attacker sends specially crafted data management protocol commands that invoke the command execution functionality.

4. Privilege Escalation: The arbitrary command executes with system privileges, granting the attacker complete control over the compromised system.

A public exploit for this vulnerability has been documented and is available through Packet Storm Security, demonstrating the practical exploitation of this flaw.

Detection Methods for CVE-2021-27878

Indicators of Compromise

• Unexpected authentication events to Backup Exec Agent services from unknown or unauthorized IP addresses
• Anomalous process spawning from Backup Exec Agent processes (e.g., cmd.exe, powershell.exe, or shell processes)
• Unusual network traffic patterns on Backup Exec communication ports
• System commands or scripts executing under the context of Backup Exec service accounts

Detection Strategies

• Monitor for authentication attempts to Backup Exec agents that do not originate from authorized backup servers
• Implement network intrusion detection rules to identify exploitation attempts targeting the SHA Authentication scheme
• Enable verbose logging on Backup Exec installations and analyze for authentication anomalies
• Deploy endpoint detection and response (EDR) solutions to detect post-exploitation activity from Backup Exec processes

Monitoring Recommendations

• Configure centralized logging for all Backup Exec agent authentication events
• Establish baseline network behavior for backup communications and alert on deviations
• Monitor process creation chains originating from Backup Exec services for suspicious child processes
• Review firewall logs for connection attempts to Backup Exec ports from unauthorized sources

How to Mitigate CVE-2021-27878

Immediate Actions Required

• Upgrade Veritas Backup Exec to version 21.2 or later immediately
• Restrict network access to Backup Exec Agent ports using firewall rules to allow only authorized backup servers
• Audit existing Backup Exec installations to identify vulnerable versions across the environment
• Review system logs on Backup Exec hosts for signs of prior exploitation

Patch Information

Veritas has addressed this vulnerability in Backup Exec version 21.2. Organizations should apply this update as soon as possible. Detailed patch information is available in the Veritas Security Advisory VTS21-001.

Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies are required to remediate within prescribed timelines, and all organizations are strongly encouraged to prioritize patching.

Workarounds

• Implement strict network segmentation to isolate Backup Exec infrastructure from general network access
• Deploy host-based firewall rules on systems running Backup Exec agents to whitelist only legitimate backup server IP addresses
• Consider disabling Backup Exec Agent services on systems where backup functionality is not actively required until patching can be completed
• Monitor for exploitation attempts while patches are being deployed across the environment

# Example: Windows Firewall rule to restrict Backup Exec Agent access
# Replace BACKUP_SERVER_IP with your authorized backup server address
netsh advfirewall firewall add rule name="Restrict Backup Exec Agent" dir=in action=allow protocol=tcp localport=10000 remoteip=BACKUP_SERVER_IP
netsh advfirewall firewall add rule name="Block Backup Exec Agent Default" dir=in action=block protocol=tcp localport=10000