此漏洞允许远程攻击者绕过受影响 Commvault CommCell 11.22.22 安装的身份验证。无需身份验证即可利用此漏洞。具体

The impact of CVE-2021-34993 is severe due to the ease of exploitation and the potential for widespread compromise. An attacker can leverage this vulnerability to gain unauthorized access to CommCell environments without needing valid credentials. This could lead to data breaches, data manipulation, system disruption, and potentially lateral movement within the network. Successful exploitation could allow an attacker to access sensitive data stored and managed by CommCell, including backups and recovery information. The lack of authentication requirements significantly lowers the barrier to entry for malicious actors.

Organizations heavily reliant on Commvault CommCell for backup and recovery are particularly at risk. Environments with legacy CommCell deployments or those lacking robust network segmentation are also more vulnerable. Shared hosting environments where multiple tenants share a CommCell instance could expose all tenants to this vulnerability.

• windows / server: Monitor CommCell service accounts for unusual activity. Check event logs for authentication failures followed by successful access. Use Sysinternals tools (e.g., Process Monitor) to observe network connections to the CVSearchService.

Get-WinEvent -LogName Security -Filter "EventID = 4625" -MaxEvents 100 | Where-Object {$_.Properties[0].Value -like '*CVSearchService*'}

• linux / server: Monitor CommCell service user accounts for unusual login attempts. Review auditd logs for authentication failures followed by successful access. Use lsof to identify processes accessing the CVSearchService.

lsof -i :8080 # Assuming CVSearchService uses port 8080

• generic web: Monitor access logs for requests to the CVSearchService endpoint without authentication headers. Look for unusual user agents or IP addresses.

grep -i 'CVSearchService' /var/log/apache2/access.log

1. 2022-01-13Disclosure

   disclosure

2. 2022-01-13Patch

   patch

1. 已保留2021-06-17
2. 发布日期2022-01-13
3. 修改日期2024-08-04
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2021-34993 is to upgrade Commvault CommCell to a patched version. Refer to the Commvault advisory for the specific fixed version. If immediate patching is not possible due to compatibility concerns or testing requirements, consider implementing network segmentation to restrict access to the CommCell server. Review and strengthen existing access controls and monitoring to detect any suspicious activity. While a WAF cannot directly prevent this authentication bypass, it can help detect and block malicious requests targeting the vulnerable endpoint. After upgrading, verify the fix by attempting to access the CVSearchService without providing valid credentials; access should be denied.