Veeam fixed a critical flaw in Veeam Backup & Replication software
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-40710 | A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive info A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication. NVD description · AI analysis pending | 8.8 group max | 1% |
| — | ||
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication Veeam Backup & Replication contains a deserialization of untrusted data flaw (CWE-502) that allows an unauthenticated attacker to send a maliciously crafted serialized payload to the product's network-facing service and achieve remote code execution, with no privileges or user interaction required (CVSS 3.1: 9.8). Successful exploitation yields full code execution on the backup server with high impact on confidentiality, integrity and availability, and is especially valuable to attackers because backup infrastructure typically stores credentials and ransomware operators seek to destroy or encrypt backups before attacking production systems. Any organization running Veeam Backup & Replication is in scope; the provided data does not specify exact affected version ranges, so consult Veeam's advisory for the affected/fixed builds. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-10-17 with known ransomware use, a public proof-of-concept has been published by watchTowr, EPSS estimates a 90.4% probability of exploitation within 30 days (100th percentile), and the exploit has been reused in Frag ransomware attacks. Do: Apply Veeam's security updates immediately (the vendor released fixes for 18 flaws, including 5 critical ones); per the KEV required action, apply mitigations per Veeam's instructions or discontinue use if mitigations are unavailable. Until patched, restrict network access to the backup server from untrusted networks and remove unnecessary internet exposure. Given confirmed ransomware exploitation, also hunt for signs of compromise on backup servers and review backup job integrity and stored credentials. | 9.8 | 90% | KEV ransomware PoC |
| mass≈ hundreds of thousands of on-prem backup server deployments plausibly affected (tens of thousands internet-exposed) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 12.1.2.172 | vulnerability. The flaw impacts Veeam Backup & Replication 12.1.2.172 and all earlier version 12 builds . The company also addres |
Full article404 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 05, 2024
Veeam addressed 18 high and critical severity flaws in Veeam Backup & Replication, Service Provider Console, and One.
Veeam released security updates to address multiple vulnerabilities impacting its products, the company fixed 18 high and critical severity flaws in Veeam Backup & Replication, Service Provider Console, and One.
The most severe flaw included in the September 2024 security bulletin is a critical, remote code execution (RCE) vulnerability tracked as CVE-2024-40711 (CVSS v3.1 score: 9.8) impacting Veeam Backup & Replication (VBR).
Veeam Backup & Replication is a comprehensive data protection and disaster recovery software developed by Veeam. It enables organizations to back up, restore, and replicate data across physical, virtual, and cloud environments.
“A vulnerability allowing unauthenticated remote code execution (RCE).” reads the advisory.
Florian Hauser, cybersecurity researcher at CODE WHITE Gmbh, reported this vulnerability.
The flaw impacts Veeam Backup & Replication 12.1.2.172 and all earlier version 12 builds.
The company also addressed a vulnerability, tracked as CVE-2024-40713 (CVSS v3.1 score: 8.8) that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.
The company also fixes a series of related high-severity vulnerabilities tracked as CVE-2024-40710, the most notable one could lead to remote code execution (RCE) as the service account and extraction of sensitive information (saved credentials and passwords). The exploitation of these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication.
The other issues included in the bulletin are impacting Backup & Replication versions 12.1.2.172 and older are:
- CVE-2024-40712: A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). (CVSS score: 7.8)
- CVE-2024-40714: A vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. (CVSS score: 8.3)
- CVE-2024-39718: A vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. (CVSS score: 8.1)
The remaining issues covered by the bulletin impact Service Provider Console, and One software.
The company did not disclose whether any of the issues in the bulletin had been exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Veeam Backup & Replication)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/168088/security/veeam-backup-replication-cve-2024-40711.html