CVE-2021-47813: Backup Key Recovery DoS Vulnerability

CVE-2021-47813 Overview

CVE-2021-47813 is a denial of service vulnerability in Backup Key Recovery 2.2.7. The flaw allows a local attacker to crash the application by submitting an oversized buffer to the registration code input field. Pasting 256 repeated characters into the registration key field triggers application instability and a potential crash. The weakness is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires user interaction on the affected host and produces an availability impact without compromising confidentiality or integrity.

Critical Impact

Local attackers can crash Backup Key Recovery 2.2.7 by submitting a 256-character buffer to the registration code field, causing loss of application availability.

Affected Products

• Backup Key Recovery 2.2.7
• NSA Auditor Tool ecosystem components referenced by the vendor
• Workstations running the vulnerable client locally

Discovery Timeline

• 2026-01-16 - CVE-2021-47813 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2021-47813

Vulnerability Analysis

The vulnerability is a classic unbounded input handling issue in the registration workflow of Backup Key Recovery 2.2.7. The application accepts a registration code from a user-controlled input field but fails to validate or constrain the length of the supplied data. When 256 repeated characters are pasted into the field, the application enters an unstable state and can terminate. The defect maps to [CWE-120], indicating a buffer copy without bounds checking. Because the attack vector is local and requires user interaction, exploitation depends on convincing a legitimate user to paste attacker-supplied data into the registration prompt. The impact is limited to availability loss of the affected application instance.

Root Cause

The registration input handler does not enforce a maximum length on the registration code string before processing it. The application copies attacker-controlled content into a fixed-size internal buffer without validating the source length, leading to memory corruption symptoms that manifest as application instability or termination. No sanitization or boundary check exists between the clipboard paste action and the internal buffer write.

Attack Vector

An attacker prepares a 256-character payload of repeating bytes and delivers it to a target user through social engineering or a staged clipboard. The user launches Backup Key Recovery 2.2.7, opens the registration dialog, and pastes the payload into the registration key field. The application processes the oversized input and crashes. The technique is documented as a denial of service proof of concept in Exploit-DB #49966 and the VulnCheck Advisory on DoS PoC.

// No verified exploit code is reproduced here. Refer to the published PoC
// at Exploit-DB #49966 for the documented input pattern used to trigger
// the crash in the registration code field.

Detection Methods for CVE-2021-47813

Indicators of Compromise

• Unexpected termination of the Backup Key Recovery process on a workstation shortly after a user interaction with the registration dialog.
• Windows Application Event Log entries showing fault module crashes tied to the vulnerable binary.
• Clipboard or input artifacts containing long runs of repeated characters delivered to the target user.

Detection Strategies

• Monitor for repeated application crash events on hosts running Backup Key Recovery 2.2.7 and correlate with active user sessions.
• Inspect endpoint telemetry for process exit codes and Windows Error Reporting entries associated with the application binary.
• Hunt for delivery of suspicious text payloads, such as long repeating character strings, through email, chat, or removable media.

Monitoring Recommendations

• Enable application crash reporting and forward Windows Event Log channels Application and Application Error to a centralized log platform.
• Track installations of Backup Key Recovery 2.2.7 across the environment to scope exposure.
• Alert on repeated crashes of the same process on a single host within a short time window.

How to Mitigate CVE-2021-47813

Immediate Actions Required

• Inventory endpoints running Backup Key Recovery 2.2.7 and restrict its use until a vendor fix is confirmed.
• Instruct users not to paste untrusted content into the registration code field.
• Remove the application from systems where it is not required for business operations.

Patch Information

No vendor patch is referenced in the available advisory data. Administrators should consult the VulnCheck Advisory on DoS PoC and the NSA Auditor Tool vendor site for updates. If a newer release of Backup Key Recovery is published, upgrade beyond version 2.2.7.

Workarounds

• Block execution of Backup Key Recovery 2.2.7 through application control policies until a fixed version is available.
• Limit local user accounts that can launch the application to reduce the attack surface for user-interaction-driven exploitation.
• Provide user awareness guidance covering paste-based denial of service techniques delivered via social engineering.

# Example application control rule (Windows AppLocker XML snippet)
# Blocks the vulnerable binary by publisher and file version
<FilePublisherRule Action="Deny" UserOrGroupSid="S-1-1-0" Description="Block Backup Key Recovery 2.2.7">
  <Conditions>
    <FilePublisherCondition PublisherName="*" ProductName="BACKUP KEY RECOVERY" BinaryName="*">
      <BinaryVersionRange LowSection="2.2.7.0" HighSection="2.2.7.*"/>
    </FilePublisherCondition>
  </Conditions>
</FilePublisherRule>