地图 / anti_ransomware_service.exe REST API does not require authentication

anti_ransomware_service.exe REST API does not require authentication

身份认证 / Missing Authentication for Critical Function / #858608

厂商: Acronis
严重程度: 低危 · CVSS 5.4
赏金: —
弱点: Missing Authentication for Critical Function
研究员: @mjoensen
披露日期: 2021-06-24
资产: Acronis Cyber Protect Home Office (formerly Acronis True Image)
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（2151 字符中的一小部分）

anti_ransomware_service.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the Acronis True Image 2020 GUI to the anti_ransomware_service.exe. This can be exploited to add an arbitary malicious executable to the whitelist or even …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Acronis 所有。

时间线

2020-04-24报告提交
2021-06-24公开披露

阅读 HackerOne 原文 ↗作者 @mjoensen · 版权归作者与 Acronis 所有

同类报告

Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · 2020-01-08 · $15,300 [c-api.city-mobil.ru] Client authentication bypass leads to information disclosureMail.ru · —Authentication bypass for ███ leads to take over any users account.Krisp · 2022-10-31 Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadataShopify · 2026-11-03 · $3,100 Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open RedirectAWS VDP · 2026-10-16 Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor dataEssity · 2026-10-14