# anti_ransomware_service.exe REST API does not require authentication

Acronis anti_ransomware_service.exe exposes an unauthenticated localhost REST API on port 6109, letting any unprivileged user whitelist malware or exclude the whole C: drive from ransomware monitoring.

- Payout: hidden
- Severity: medium
- Program: Acronis
- Found by: mjoensen
- Disclosed: 2021-06-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/858608
- Library page: https://bugbountylibrary.com/r/h1%3A858608
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:rest vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** anti_ransomware_service.exe local REST API (localhost:6109)
**Root cause:** The service's REST API on localhost:6109 accepts PUT requests to /lists/processImages/white and /lists/excludes without any authentication or caller verification, so any local user can modify the protection configuration.
**Steps:**
1. Send `PUT http://localhost:6109/lists/processImages/white` with headers `User-Agent: AcronisRestClient`, `Content-Type: application/json` and body `{"additions":[{"path":"C:\\ProgramData\\ransomware_exe.exe"}],"removals":[]}` to whitelist an executable.
2. Send `PUT http://localhost:6109/lists/excludes` with body `{"additions":[{"path":"C:\\*"}],"removals":[]}` to exclude the entire C: drive from monitoring.
3. Verify in the Acronis True Image 2020 GUI that the executable is whitelisted / the path is excluded.
**Exploitation:** A local unprivileged attacker or malware running as a normal user issues unauthenticated PUT requests to the loopback REST API to add a malicious executable to the whitelist or exclude C:\* from anti-ransomware scanning, silently disabling protection before deploying ransomware.
**Insight:** Desktop security products often run a privileged service with a loopback REST API for their GUI; enumerate localhost ports and probe for unauthenticated config-mutating endpoints that weaken the product's own protection.