यह भेद्यता प्रभावित Commvault CommCell 11.22.22 इंस्टॉलेशन पर प्रमाणीकरण को बायपास करने की अनुमति देती है। इस भेद्यता का फायदा उठाने के लिए प्रमाणीकरण की आवश्यकता नहीं है। विशिष्ट

The impact of CVE-2021-34993 is severe due to the ease of exploitation and the potential for widespread compromise. An attacker can leverage this vulnerability to gain unauthorized access to CommCell environments without needing valid credentials. This could lead to data breaches, data manipulation, system disruption, and potentially lateral movement within the network. Successful exploitation could allow an attacker to access sensitive data stored and managed by CommCell, including backups and recovery information. The lack of authentication requirements significantly lowers the barrier to entry for malicious actors.

Organizations heavily reliant on Commvault CommCell for backup and recovery are particularly at risk. Environments with legacy CommCell deployments or those lacking robust network segmentation are also more vulnerable. Shared hosting environments where multiple tenants share a CommCell instance could expose all tenants to this vulnerability.

• windows / server: Monitor CommCell service accounts for unusual activity. Check event logs for authentication failures followed by successful access. Use Sysinternals tools (e.g., Process Monitor) to observe network connections to the CVSearchService.

Get-WinEvent -LogName Security -Filter "EventID = 4625" -MaxEvents 100 | Where-Object {$_.Properties[0].Value -like '*CVSearchService*'}

• linux / server: Monitor CommCell service user accounts for unusual login attempts. Review auditd logs for authentication failures followed by successful access. Use lsof to identify processes accessing the CVSearchService.

lsof -i :8080 # Assuming CVSearchService uses port 8080

• generic web: Monitor access logs for requests to the CVSearchService endpoint without authentication headers. Look for unusual user agents or IP addresses.

grep -i 'CVSearchService' /var/log/apache2/access.log

1. 2022-01-13Disclosure

   disclosure

2. 2022-01-13Patch

   patch

1. आरक्षित2021-06-17
2. प्रकाशित2022-01-13
3. संशोधित2024-08-04
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2021-34993 is to upgrade Commvault CommCell to a patched version. Refer to the Commvault advisory for the specific fixed version. If immediate patching is not possible due to compatibility concerns or testing requirements, consider implementing network segmentation to restrict access to the CommCell server. Review and strengthen existing access controls and monitoring to detect any suspicious activity. While a WAF cannot directly prevent this authentication bypass, it can help detect and block malicious requests targeting the vulnerable endpoint. After upgrading, verify the fix by attempting to access the CVSearchService without providing valid credentials; access should be denied.