A proof-of-concept (PoC) exploit for a critical vulnerability in Veeam Backup Enterprise Manager (VBEM) is now publicly available, making it urgent for administrators to apply the latest security updates.
Veeam Backup Enterprise Manager is a web-based platform for managing Veeam Backup & Replication installations through a web console. It helps control backup jobs and perform recovery tasks.
The vulnerability, for which a PoC exploit has been released, is tracked as CVE-2024-29849 and allows authentication bypass. Veeam issued a security bulletin for the vulnerability on May 21, warning that it allows remote, unauthorized attackers to log in to the VBEM web interface as any user.
The company urged customers to fix the securityby upgrading to VBEM version 12.1.2.172, while also providing some advice for those who cannot apply the update immediately.
See also: Increasing vulnerabilities in IoT devices
In a report by Sina Kheirkha, the cybersecurity researcher explains that the flaw lies in the “Veeam.Backup.Enterprise.RestAPIService.exe” service, which is associated with TCP port 9398 and acts as a REST API server for the main web application.
The exploit involves sending a specially crafted VMware single-sign-on (SSO) token to the vulnerable service using the Veeam API.
The token contains an authentication request impersonating an administrator and an SSO service URL that Veeam does not verify.
The SSO token is decoded and interpreted in XML format to verify its validity via a SOAP request to a URL controlled by the attacker.
This server, created by the attacker, responds positively to validation requests, so Veeam accepts the authentication request and grants access administrator
See also: SolarWinds: Patches vulnerability reported by NATO Pentester
The provided exploit shows all the steps to exploit the vulnerability.
How to protect yourself from this Veeam vulnerability?
There is currently no evidence of exploitation of CVE-2024-29849, but the public availability of a working exploit puts users at risk. Therefore, updating to version 12.1.2.172 or later is critical.
Organizations should take this exploit, which targets Veeam Backup Enterprise Manager, as a wake-up call to always prioritize applying security. Waiting to address vulnerabilities can leave systems and sensitive data at risk.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Additionally, organizations should regularly conduct security audits and penetration tests to uncover potential vulnerabilities before attackers can exploit them. This proactive approach can help prevent such attacks in the first place.
Finally, it is important for organizations to adopt a strong security culture and encourage employees to report any suspicious activity or vulnerability they may encounter. With the ever-evolving cyber threat landscape ,it is essential for organizations to remain vigilant and protect their systems and data. By staying informed and implementing best practices, organizations can better protect themselves from potential attacks.
See also: PHP: Fix vulnerability affecting all Windows versions
Those who cannot apply the update should do the following to mitigate the risk:
- Restrict access to the VBEM web interface, limiting network access to only trusted IP addresses.
- Implement firewall rules to block unauthorized access to ports used by Veeam services (e.g. port 9398 for the REST API).
- Enable multi-factor authentication for all accounts that access VBEM.
- Web Application Firewall application to detect and block malicious requests targeting VBEM.
- Regularly check access logs for any suspicious or unauthorized access attempts.
- Isolation of VBEM server from other critical systems within the network to limit the risk of lateral movement.
Source: www.bleepingcomputer.com
