N-able N-central Update: Make Sure Legacy API Is Turned Off

Yesterday we wrote about critical flaws in N-able N-central, the remote monitoring and management (RMM) platform many IT providers use to look after their clients' computers, and the Hotfix 2 update N-able released on November 10. Late on November 11 the same researcher published more exploit code, and this time it is said to work against servers that already have Hotfix 2 installed.

The short version: if your IT provider runs N-central on its own server, ask them to confirm the "Legacy API" setting is turned off, and that your computers' Agents and Probes are still being updated to Hotfix 2.

What changed

The new code comes in two parts. "4EverAble2Shell" targets the N-central server and, according to the researcher, lets an attacker with no password run commands as root. "Agent2Shell" targets how the server talks to the Windows Agents on managed computers; the researcher says it can run commands on those computers with full SYSTEM rights.

N-able says its initial review found the server issue depends on a non-default setup: the Legacy API turned on and reachable from the public internet. Legacy API is off by default. The researcher later updated his notes to confirm the server exploit only works with Legacy API enabled. N-able says hosted N-central environments are not affected by the server issue.

N-able says it has seen no signs of compromise. Separately, security firm Previdian told BleepingComputer it saw attackers probing for and trying the full exploit chain within hours of the code going public, and Huntback reported finding at least 21 N-central servers running cryptocurrency-mining software, 19 of them on Hotfix 2.

What N-able is doing

• Restricting some N-central features and integrations while it works on more fixes, which may affect some functionality.
• Turning off the Microsoft Intune integration as a precaution, for both hosted and on-premises customers.
• Asking all customers to keep upgrading their Agents and Probes under the earlier Hotfix 2 guidance.

What to do this week

1. Ask your IT provider whether they use N-central, and whether it is hosted or on-premises. N-able has already applied the new protections to hosted environments.
2. On-premises: turn off Legacy API. N-able says to disable it now if it is enabled, and otherwise confirm it is still off. N-able has a knowledge base article with the steps.
3. If Legacy API has to stay on, keep it off the internet. Huntress advises restricting access to the server until N-able provides a fix.
4. Keep updating Agents and Probes. Hotfix 2 is still needed; N-able says to upgrade Agents first, then Probes.
5. Check for signs of trouble. If Legacy API was on and reachable from the internet, Huntress recommends reviewing server and endpoint activity from November 11 onward. Unusually high CPU use on the server is worth a look, since the attacks reported so far installed mining software.

Questions to ask your IT provider

1. Do you use N-central to manage our computers, and is it hosted or on your own server?
2. Is Legacy API turned off, and has it ever been turned on?
3. Are our Agents and Probes on Hotfix 2, and have you reviewed the server and our computers for unusual activity since November 11?

This is still a fast-moving situation, and N-able says it will post updates on its status page as remediation continues.