Veeam Backup & Replication RCE flaw may soon be leveraged by ransomware gangs (CVE-2024-40711)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials Veeam Backup & Replication (VBR) contains a missing-authentication flaw (CWE-306) in its Cloud Connect component that lets an unauthenticated network attacker obtain encrypted credentials stored in VBR's configuration database. It is triggered simply by connecting to the exposed service, because the function that serves credential material performs no authentication check; no privileges or user interaction are required (CVSS 3.1: 7.5, network vector). With the recovered credentials, an attacker can gain access to backup infrastructure hosts, which has been used as an entry point and pivot for ransomware operations. Any organization running Veeam Backup & Replication is potentially affected, with the greatest risk where the VBR/Cloud Connect service is reachable from the internet. Exploitation is confirmed: CISA added the bug to its KEV catalog on 2023-08-22 with known ransomware use, the Cuba ransomware group has been observed stealing credentials through this exploit, and EPSS assigns a 77.6% near-term exploitation probability (100th percentile). Do: Apply the fixes Veeam provides in its security advisory immediately — per CISA's KEV listing, patch per vendor instructions or discontinue use — prioritizing internet-facing Cloud Connect servers. After patching, rotate all credentials stored in the configuration database, since they should be considered exposed, and review those accounts for signs of misuse. Restrict network access to the VBR service from untrusted networks and check servers for exploitation indicators such as unexpected connections to the service or anomalous logins with stored credentials. | 7.5 | 78% | KEV ransomware |
| largetens of thousands of deployments, of which thousands are internet-exposed (estimate) | |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication Veeam Backup & Replication contains a deserialization of untrusted data flaw (CWE-502) that allows an unauthenticated attacker to send a maliciously crafted serialized payload to the product's network-facing service and achieve remote code execution, with no privileges or user interaction required (CVSS 3.1: 9.8). Successful exploitation yields full code execution on the backup server with high impact on confidentiality, integrity and availability, and is especially valuable to attackers because backup infrastructure typically stores credentials and ransomware operators seek to destroy or encrypt backups before attacking production systems. Any organization running Veeam Backup & Replication is in scope; the provided data does not specify exact affected version ranges, so consult Veeam's advisory for the affected/fixed builds. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-10-17 with known ransomware use, a public proof-of-concept has been published by watchTowr, EPSS estimates a 90.4% probability of exploitation within 30 days (100th percentile), and the exploit has been reused in Frag ransomware attacks. Do: Apply Veeam's security updates immediately (the vendor released fixes for 18 flaws, including 5 critical ones); per the KEV required action, apply mitigations per Veeam's instructions or discontinue use if mitigations are unavailable. Until patched, restrict network access to the backup server from untrusted networks and remove unnecessary internet exposure. Given confirmed ransomware exploitation, also hunt for signs of compromise on backup servers and review backup job integrity and stored credentials. | 9.8 | 90% | KEV ransomware PoC |
| mass≈ hundreds of thousands of on-prem backup server deployments plausibly affected (tens of thousands internet-exposed) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 12.1.2.172 | lisation bug, and that Veeam has fixed the first one in VBR 12.1.2.172 (released in late May) and has delivered a patch for the de |
Full article602 words · extracted from helpnetsecurity.com · click to collapse
CVE-2024-40711, a critical vulnerability affecting Veeam Backup & Replication (VBR), could soon be exploited by attackers to steal enterprise data.
Discovered and reported by Code WHite researcher Florian Hauser, the vulnerability can be leveraged for full system takeover, and security researchers from watchTowr Labs have already confirmed its potential for exploitation.
Luckily for enterprises using VBR, both companies have refrained from sharing PoC exploit code or additional details about the flaw until most admins have had a chance to implement the fix Veeam provided last week.
About CVE-2024-40711
Veeam Backup & Replication is a popular enterprise solution for backing up, replicating and and restoring backups of virtual environments, physical machines and cloud-based workloads.
Ransomware groups have previously exploited vulnerabilities (e.g., CVE-2023-27532) in VBR to gain access to organizations’ backup infrastructure.
CVE-2024-40711 is an unspecified vulnerability affecting VBR version 12.1.2.172 and all earlier versions.
“CVE-2024-40711 could allow an attacker to gain full control of a system, manipulate data, and potentially move laterally within a network, making it a relatively high-value target for threat actors,” Censys researchers noted on Friday.
They also pinpointed 2,833 internet-facing Veeam Backup & Replication servers exposed on the Internet, mostly concentrated in Germany and France – but how many of those are vulnerable is unknown.
Fix is available
Veeam has fixed CVE-2024-40711 and five other less critical flaws affecting VBR on Thursday, and has urged admins to update to Veeam Backup & Replication 12.2 (build 12.2.0.334). The company did not mention possible workarounds for any of them.
Simultaneously, the company issued fixes for a variety of vulnerabilities in:
- Veeam Agent for Linux
- Veeam ONE (monitoring and analytics solution for IT workloads)
- Veeam Backup for Nutanix AHV and Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization, and
- Veeam Service Provider Console (a solution for managing data backup operations, used by MSPs and enterprises).
UPDATE (September 10, 2024, 06:05 a.m. ET):
WatchTowr Labs’ researcher Sina Kheirkhan has shared their analysis where they compared the latest few VBR versions provided by Veeam.
They reckon that CVE-2024-40711 is comprised of two separate components: an improper authorization bug and a deserialisation bug, and that Veeam has fixed the first one in VBR 12.1.2.172 (released in late May) and has delivered a patch for the deserialisation bug last week, with VBR 12.2.0.334.
They have also seemingly found that the later patch does not fix CVE-2024-40711 completely, but says that they will explain their finding at a later date, since details are still under embargo. They have also refrained from publishing exploit code, because they are worried about the bug being very valuable to ransomware operators.
“There’s no point deploying cryptolocker malware on a target unless you can also deny access to backups, and so, this class of attackers absolutely loves to break this particular software,” Kheirkhan noted.
“Veeam Backup & Replication has a large deployment footprint,” says Rapid7, and thinks it likely that one or more of the patched VBR vulnerabilities may end up being used to facilitate extortion attacks.
“More than 20% of Rapid7 incident response cases in 2024 so far have involved Veeam being accessed or exploited in some manner, typically once an adversary has already established a foothold in the target environment,” the company noted.
UPDATE (October 1, 2024, 04:45 a.m. ET):
A PoC exploit for CVE-2024-40711 has been released by WatchTowr Labs two weeks ago.
UPDATE (October 11, 2024, 10:15 a.m. ET):
Ransomware affiliates using Fog and Akira ransomware are exploiting the vulnerability, says Sophos X-Ops.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/09/09/cve-2024-40711-exploited/