Critical Commvault Command Center Flaw Enables Attackers to Execute Code Remotely
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-34028 | Unauthenticated Path Traversal RCE in Commvault Command Center Commvault Command Center (Innovation Release 11.38.0 through 11.38.20) is vulnerable to a path traversal flaw (CWE-22) that requires no authentication (CWE-306). An unauthenticated remote attacker uploads a maliciously crafted ZIP file masquerading as an install package to the Command Center web interface; when the target server expands the archive, path traversal lets attacker-controlled files, including malicious JSP webshells, be written outside the intended location. The result is unauthenticated remote code execution on the backup management server, giving attackers a foothold in a core enterprise data-protection component. Any organization running the affected 11.38 release train of Command Center is exposed, particularly if the console is reachable from the internet. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-02, carries a 97.7% EPSS exploitation probability, and public PoC exploit code is available. Do: Upgrade Command Center to 11.38.20 with hotfixes SP38-CU20-433 and SP38-CU20-436, or to 11.38.25 with SP38-CU25-434 and SP38-CU25-438. Until patched, restrict internet exposure of the Command Center web console and check for signs of compromise such as unexpected JSP files or webshells written by the application. Federal agencies must apply vendor mitigations per CISA BOD 22-01 guidance or discontinue use of the product. | 9.3 | 98% | KEV PoC |
| largelikely tens of thousands of enterprise deployments running the affected 11.38 release train, of which roughly hundreds to a few thousand Command Center… |
Full article366 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 24, 2025Data Breach / Vulnerability
A critical security flaw has been disclosed in the Commvault Command Center that could allow arbitrary code execution on affected installations.
The vulnerability, tracked as CVE-2025-34028, carries a CVSS score of 9.0 out of a maximum of 10.0.
"A critical security vulnerability has been identified in the Command Center installation, allowing remote attackers to execute arbitrary code without authentication," Commvault said in an advisory published on April 17, 2025. "This vulnerability could lead to a complete compromise of the Command Center environment."
It impacts the 11.38 Innovation Release, from versions 11.38.0 through 11.38.19, and has been resolved in the following versions -
- 11.38.20
- 11.38.25
watchTowr Labs researcher Sonny Macdonald, who has been credited with discovering and reporting the flaw on April 7, 2025, said in a report shared with The Hacker News that it could be exploited to achieve pre-authenticated remote code execution.
Specifically, the issue is rooted in an endpoint called "deployWebpackage.do," triggering what's called a pre-authenticated Server-Side Request Forgery (SSRF) owing to the fact that there is "no filtering as to what hosts can be communicated with."
To make matters worse, the SSRF flaw could then be escalated to achieve code execution by making use of a ZIP archive file containing a malicious .JSP file. The entire sequence of events is as follows -
- Send an HTTP request to /commandcenter/deployWebpackage.do, causing the Commvault instance to retrieve a ZIP file from an external server
- Contents of the ZIP file get unzipped into a .tmp directory under the attacker's control
- Use the servicePack parameter to traverse the .tmp directory into a pre-authenticated facing directory on the server, such as ../../Reports/MetricsUpload/shell
- Execute the SSRF via /commandcenter/deployWebpackage.do
- Execute the shell from /reports/MetricsUpload/shell/.tmp/dist-cc/dist-cc/shell.jsp
watchTowr has also created a Detection Artefact Generator that organizations can use to determine if their instance is vulnerable to the vulnerability.
With vulnerabilities in backup and replication software like Veeam and NAKIVO coming under active exploitation in the wild, it's essential that users apply necessary mitigations to safeguard against potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/04/critical-commvault-command-center-flaw.html