Veeam fixed multiple flaws in Veeam ONE, including critical issues
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials Veeam Backup & Replication (VBR) contains a missing-authentication flaw (CWE-306) in its Cloud Connect component that lets an unauthenticated network attacker obtain encrypted credentials stored in VBR's configuration database. It is triggered simply by connecting to the exposed service, because the function that serves credential material performs no authentication check; no privileges or user interaction are required (CVSS 3.1: 7.5, network vector). With the recovered credentials, an attacker can gain access to backup infrastructure hosts, which has been used as an entry point and pivot for ransomware operations. Any organization running Veeam Backup & Replication is potentially affected, with the greatest risk where the VBR/Cloud Connect service is reachable from the internet. Exploitation is confirmed: CISA added the bug to its KEV catalog on 2023-08-22 with known ransomware use, the Cuba ransomware group has been observed stealing credentials through this exploit, and EPSS assigns a 77.6% near-term exploitation probability (100th percentile). Do: Apply the fixes Veeam provides in its security advisory immediately — per CISA's KEV listing, patch per vendor instructions or discontinue use — prioritizing internet-facing Cloud Connect servers. After patching, rotate all credentials stored in the configuration database, since they should be considered exposed, and review those accounts for signs of misuse. Restrict network access to the VBR service from untrusted networks and check servers for exploitation indicators such as unexpected connections to the service or anomalous logins with stored credentials. | 7.5 | 78% | KEV ransomware |
| largetens of thousands of deployments, of which thousands are internet-exposed (estimate) | |
| CVE-2023-38547 | A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration datab A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database. NVD description · AI analysis pending | 9.8 group max | 19% |
| — |
Full article363 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 07, 2023
Veeam addressed multiple vulnerabilities in its Veeam ONE IT infrastructure monitoring and analytics platform, including two critical issues.
Veeam addressed four vulnerabilities (CVE-2023-38547, CVE-2023-38548, CVE-2023-38549, CVE-2023-41723) in the Veeam ONE IT infrastructure monitoring and analytics platform.
The vulnerability CVE-2023-38547 (CVSS score 9.9) can be exploited by an unauthenticated attacker to gain information about the SQL server connection Veeam ONE uses to access its configuration database.
“A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database.” reads the advisory. “This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.”
Affected Version(s) are Veeam ONE 11, 11a, 12..
The second critical flaw, tracked as CVE-2023-38548 (CVSS score 9.8), can be exploited by an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.
The vulnerability only affects Veeam ONE 12.
The remaining vulnerabilities, tracked as CVE-2023-38549 and CVE-2023-41723, are medium-severity flaws.
The vulnerability CVE-2023-38549 (CVSS score: 4.5) allows a user with the Veeam ONE Power User role to obtain the access token of a user with the Veeam ONE Administrator role by carrying out an XSS attack.
The last vulnerability, tracked as CVE-2023-41723 (CVSS score: 4.3), can be exploited by a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.
The issue affects Veeam ONE versions 11, 11a, 12
In March, Veeam addressed a high-severity flaw, tracked as CVE-2023-27532, in Veeam Backup and Replication (VBR) software. An unauthenticated user with access to the Veeam backup service (TCP 9401 by default) can exploit the flaw to request cleartext credentials.
A remote attacker can exploit the flaw to access the backup systems of a target organization and execute arbitrary code as ‘SYSTEM.’
After the public disclosure of the vulnerability, the researchers at Horizon3’s Attack Team published technical details for this vulnerability along with a PoC exploit code.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Veeam ONE)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/153790/security/veeam-one-multiple-vulnerabilities.html