Commvault Webserver Vulnerability Let Attackers Compromise Webserver

Commvault, a global leader in enterprise data protection and management solutions, has urgently patched a high-severity webserver vulnerability that enables attackers to compromise systems by creating and executing malicious webshells. The flaw affects multiple versions of Commvault’s software across Linux and Windows platforms, posing significant risks of unauthorized access, data exfiltration, and systemic breaches. The […] The post Commvault Webserver Vulnerability Let Attackers Compromise Webserver appeared first on Cyber Security News.

Mar 10, 2025 - 08:29

Commvault Webserver Vulnerability Let Attackers Compromise Webserver

Commvault, a global leader in enterprise data protection and management solutions, has urgently patched a high-severity webserver vulnerability that enables attackers to compromise systems by creating and executing malicious webshells.

The flaw affects multiple versions of Commvault’s software across Linux and Windows platforms, posing significant risks of unauthorized access, data exfiltration, and systemic breaches.

The vulnerability resides in the webserver component of Commvault’s software stack, where improper input validation allows threat actors to inject and execute arbitrary code via webshells.

These stealthy scripts grant persistent remote access, enabling attackers to bypass authentication, manipulate protected data, and pivot to other network resources.

Webshells typically written in ASP, PHP, or JSP are often deployed through compromised file upload mechanisms or injection attacks.

In this case, the flaw permits attackers to write executable files to the webserver directory and trigger them via HTTP requests.

Commvault’s advisory explicitly warns that “Webservers can be compromised through bad actors creating and executing webshells,” highlighting the direct path to system takeover.

Affected Software Versions

The vulnerability impacts all supported Commvault versions from 11.20 through 11.36.

Patched releases were initially rolled out on March 4, 2025, with additional fixes on March 7 to strengthen webserver security.

Organizations must update both CommServe and Web Server components to the resolved versions.

Delaying patches risks exploitation, as webshells can evade traditional detection systems while maintaining covert access.

Mitigations

Commvault mandates immediate installation of maintenance releases via the “Software Updates on Demand” utility. Administrators should:

Validate current software versions using the Get-CommVaultVersion PowerShell cmdlet.
Download patches from Commvault’s secured repository using TLS 1.2+ protocols.
Deploy updates during maintenance windows, ensuring compatibility with linked modules like the CommCell Console and Content Store.

Network segmentation and strict inbound/outbound firewall rules for Commvault’s web ports (e.g., TCP/80, TCP/443) are critical interim measures for environments requiring delayed patching.

Additionally, audit logs for anomalous POST requests to /webconsole/API or unexpected *.jspx file creations can help detect exploit attempts.

Although the exploit specifics remain undisclosed, third-party researchers speculate it involves improper sanitization of user-supplied paths in file upload handlers.

With Commvault software integral to global data protection infrastructures spanning financial, healthcare, and government sectors—this vulnerability demands prioritized remediation. Security teams should:

Scan networks for unpatched instances using version-check scripts.
Monitor for IOCs like unexpected cmd.exe spawns or connections to suspicious IPs.
Review third-party integrations (e.g., SAP HANA, Oracle DB) reliant on Commvault APIs.

Failure to patch risks catastrophic breaches, akin to the 2023 ransomware campaign exploiting a similar flaw in Apache ActiveMQ (CVE-2023-46604).

As cybercriminals increasingly target backup systems, securing Commvault environments becomes paramount to ensuring organizational resilience.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

The post Commvault Webserver Vulnerability Let Attackers Compromise Webserver appeared first on Cyber Security News.