Full Report
Huntress has validated an initial report for an authentication bypass and sensitive file leak present in the Java framework “ZK”, used within the ConnectWise R1Soft software Server Backup Manager SE.
Analysis Summary
# Vulnerability: ConnectWise R1Soft Server Backup Manager Authentication Bypass and RCE
## CVE Details
- **CVE ID:** CVE-2022-36537
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication) / CWE-200 (Exposure of Sensitive Information)
## Affected Systems
- **Products:** ConnectWise R1Soft Server Backup Manager (SBM) SE; any software utilizing the Java framework "ZK".
- **Versions:** R1Soft SBM versions prior to v6.17.3; ZK Framework versions prior to v9.7.2, v9.6.4, and v9.0.1.2.
- **Configurations:** Systems where the ZK library is exposed to the network, particularly within the R1Soft web interface.
## Vulnerability Description
The vulnerability originates in the **ZK Java framework**, a UI library used by R1Soft. It is an authentication bypass flaw that allows an unauthenticated attacker to retrieve sensitive files from the server. By exploiting this flaw, attackers can leak server private keys, software licenses, and system configuration files. In the context of R1Soft, this access can be elevated to **Remote Code Execution (RCE)** by uploading a malicious JDBC database driver or utilizing the administrative REST API.
## Exploitation
- **Status:** Exploited in the wild. Huntress and Fox-IT have confirmed active exploitation by threat actors to deploy backdoors.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Leakage of private keys and system configurations).
- **Integrity:** Total (Ability to execute arbitrary code and push malicious updates).
- **Availability:** Total (Potential for full system takeover and downstream agent disruption).
- **Supply Chain Risk:** High. Attackers can use the compromised SBM server to push commands/malware to all registered backup agents on downstream endpoints.
## Remediation
### Patches
- **ConnectWise R1Soft:** Upgrade to **Server Backup Manager v6.17.3** or later.
- **ZK Framework:** Upgrade to versions **9.7.2, 9.6.4, or 9.0.1.2** if using the library in custom applications.
### Workarounds
- There are no primary workarounds that replace the necessity of patching.
- Restrict access to the SBM web interface to trusted IP addresses via firewall/VPN to limit the attack surface.
## Detection
- **Indicators of Compromise:**
- Presence of unrecognized JDBC drivers in the application environment.
- Log entries showing unauthorized access to the `/zkau` endpoint.
- Deployment of unexpected files (e.g., `app_log.so`) or backdoors on the backup manager server.
- **Detection Methods:** Monitor R1Soft server logs for unusual REST API calls or administrative actions not initiated by authorized users.
## References
- **ConnectWise Trust Center:** hxxps[://]www[.]connectwise[.]com/company/trust
- **Huntress Technical Analysis:** hxxps[://]www[.]huntress[.]com/blog/critical-vulnerability-disclosure-connectwise-r1soft-server-backup-manager-remote-code-execution-supply-chain-risks
- **Fox-IT Research:** hxxps[://]blog[.]fox-it[.]com/2023/02/22/from-backup-to-backdoor-exploitation-of-cve-2022-36537-in-r1soft-server-backup-manager/
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2022-36537