CVE-2020-29493

Vulnerability

A SQL injection vulnerability exists in the Fitness Analyzer component of DELL EMC Avamar Server versions 19.1, 19.2, and 19.3 [1]. The vulnerability allows a remote unauthenticated attacker to inject arbitrary SQL commands into the application's backend database queries. No prior authentication or special privileges are required to reach the vulnerable code path [1].

Exploitation

An attacker with network access to an affected Avamar Server can send crafted HTTP requests to the Fitness Analyzer endpoint, containing malicious SQL payloads in input parameters [1]. The application fails to properly sanitize or parameterize these inputs, leading to execution of attacker-controlled SQL commands on the backend database. No authentication or user interaction is needed [1].

Impact

Successful exploitation results in unauthorized read and write access to the application database [1]. An attacker can extract or modify sensitive backup data, potentially leading to data leakage or deletion of backup information. The CVSS v3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical impact on confidentiality, integrity, and availability [1].

Mitigation

Dell EMC recommends upgrading to a fixed version of Avamar Server. As of the advisory publication (2021-01-14), the vendor has released security updates addressing this vulnerability. Users should apply the latest patched version as described in Dell security advisory DSA-2020-272 [1]. No workarounds are mentioned in the available references [1].