CVE-2024-0800: Arcserve UDP Path Traversal Vulnerability

CVE-2024-0800 Overview

CVE-2024-0800 is a path traversal vulnerability in Arcserve Unified Data Protection (UDP) versions 9.2 and 8.1. The flaw resides in the ImportNodeServlet class within edge-app-base-webui.jar, specifically in com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet. Authenticated attackers with low privileges can traverse the file system and upload files to unintended locations. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). Successful exploitation impacts confidentiality, integrity, and availability of the backup infrastructure, which typically holds sensitive enterprise data.

Critical Impact
Authenticated network attackers can upload arbitrary files to controlled paths on Arcserve UDP servers, potentially leading to code execution and full compromise of backup infrastructure.

Affected Products

Arcserve Unified Data Protection 8.1
Arcserve Unified Data Protection 9.2
edge-app-base-webui.jar component containing ImportNodeServlet

Discovery Timeline

2024-03-13 - CVE-2024-0800 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0800

Vulnerability Analysis

The vulnerability exists in the ImportNodeServlet component of the Arcserve UDP web management interface. The servlet processes node import requests but fails to properly validate or sanitize file path parameters supplied by the client. This missing validation allows attackers to inject directory traversal sequences and write files outside the intended directory. Because Arcserve UDP runs backup and recovery services with elevated privileges, files written through this path can be leveraged to execute code in the context of the backup service. The attack requires network access and authenticated low-privilege credentials but no user interaction.

Root Cause

The root cause is improper neutralization of path elements in file upload handling. The com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet class accepts user-controlled filename or path parameters and passes them to file system operations without normalizing traversal sequences such as ../. This is a classic CWE-434 issue compounded by path traversal, allowing arbitrary write locations for uploaded content.

Attack Vector

An attacker with valid low-privilege credentials to the Arcserve UDP web console sends a crafted HTTP request to the ImportNodeServlet endpoint. The request includes a filename parameter containing directory traversal sequences that escape the expected upload directory. The servlet writes the attacker-supplied file contents to a location such as a web application directory or startup path. From there, the attacker can trigger execution of the uploaded payload through the web server or a scheduled task. Refer to the Tenable Research Advisory for technical exploitation details.

Detection Methods for CVE-2024-0800

Indicators of Compromise

Unexpected files appearing in Arcserve UDP web application directories or Java classpath locations
HTTP POST requests to ImportNodeServlet containing ../ or URL-encoded traversal sequences (%2e%2e%2f)
New JSP, WAR, or executable files with recent modification timestamps in UDP install paths
Anomalous child processes spawned by the Arcserve UDP web service account

Detection Strategies

Inspect Arcserve UDP web server access logs for requests to ImportNodeServlet with suspicious path parameters
Monitor file integrity on Arcserve UDP installation directories, especially webui and edge-app folders
Alert on file uploads containing executable extensions (.jsp, .war, .class, .bat) processed by the UDP servlet
Correlate authentication events with subsequent file write activity on the UDP host

Monitoring Recommendations

Enable verbose logging on the Arcserve UDP Tomcat or embedded web server
Forward web access logs and Windows Security events to a centralized SIEM for correlation
Baseline normal servlet request patterns and alert on parameter anomalies
Track privileged account usage on Arcserve UDP consoles for lateral movement indicators

How to Mitigate CVE-2024-0800

Immediate Actions Required

Upgrade Arcserve UDP to a version released after March 2024 that addresses CVE-2024-0800
Restrict network access to the Arcserve UDP web management interface using firewall rules or ACLs
Rotate credentials for any accounts with access to the UDP console
Audit the UDP host file system for unauthorized files placed since deployment

Patch Information

Arcserve released updates that resolve the path traversal in ImportNodeServlet. Administrators should consult the Tenable Research Advisory and Arcserve support channels for the fixed build numbers applicable to UDP 8.1 and 9.2. Apply the vendor patch on all UDP recovery point servers, console servers, and agents that expose the web UI.

Workarounds

Place the Arcserve UDP console behind a VPN or reverse proxy that enforces strict authentication
Remove or disable low-privilege accounts that do not require console access
Apply web application firewall rules that block traversal sequences targeting ImportNodeServlet
Segment backup infrastructure from general user networks to reduce authenticated attack surface

bash

# Example WAF rule concept blocking traversal in ImportNodeServlet requests
SecRule REQUEST_URI "@contains ImportNodeServlet" \
    "chain,deny,status:403,id:1002024,msg:'CVE-2024-0800 traversal attempt'"
    SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"