Full Report
We cover CVE-2023-27532, a vulnerability in the Veeam Backup & Replication component that allowed an unauthenticated user to retrieve host credentials.
Analysis Summary
# Vulnerability: Veeam Backup & Replication Unauthenticated Credential Retrieval
## CVE Details
- **CVE ID:** CVE-2023-27532
- **CVSS Score:** 7.5 (High)
- **CWE:** Not explicitly stated in text (typically associated with CWE-287: Improper Authentication or CWE-306: Unauthenticated Access to Critical Function).
## Affected Systems
- **Products:** Veeam Backup & Replication
- **Versions:**
- All versions prior to V12 (build 12.0.0.1420 P20230223)
- All versions prior to V11a (build 11.0.1.1261 P20230227)
- **Configurations:** Systems running the `Veeam.Backup.Service.exe` component with TCP port **9401** accessible.
## Vulnerability Description
The flaw resides in the Veeam Backup & Replication service. An unauthenticated user can interface with the exposed API of the backup service to request and retrieve host credentials stored within the configuration database. These credentials, which include usernames and passwords for managed hosts and devices, are returned in a format that can be easily decrypted by the attacker.
## Exploitation
- **Status:** PoC available. Researchers (Code White GmbH and Horizon3.ai) successfully developed exploits. At the time of the report, exploitation was anticipated, though widespread "in-the-wild" exploitation was initially just beginning to be tracked.
- **Complexity:** Low (requires simple API interaction).
- **Attack Vector:** Network (specifically targeting TCP port 9401).
## Impact
- **Confidentiality:** High (Retrieval of stored plain-text/decrypted credentials for the entire backup infrastructure).
- **Integrity:** High (Exposed credentials allow for lateral movement and potential unauthorized modification of managed systems).
- **Availability:** High (Access to backup infrastructure could lead to the deletion or corruption of backups).
## Remediation
### Patches
Users should upgrade to the following builds or newer:
- **Veeam Backup & Replication V12:** Build 12.0.0.1420 P20230223
- **Veeam Backup & Replication V11a:** Build 11.0.1.1261 P20230227
### Workarounds
- **Firewall Restrictions:** Block external access to TCP port 9401 at the network perimeter.
- **Access Control:** Restrict access to the Veeam Backup server to only authorized management consoles and trusted IP addresses.
## Detection
- **Indicators of Compromise:** Unusual connection attempts to TCP port 9401 from unauthorized or external IP addresses.
- **Detection Methods:**
- **Version Check:** Run the following PowerShell command to identify the current build:
`$CoreDllPath = (Get-ItemProperty -Path "HKLM:\Software\Veeam\Veeam Backup and Replication\" | Select-Object -ExpandProperty CorePath) + "Veeam.Backup.Core.dll"; $CoreDll = Get-Item -Path $CoreDllPath; $CoreDll.VersionInfo.ProductVersion`
- **Log Analysis:** Monitor logs for the `Veeam.Backup.Service.exe` process for unexpected API calls or credential access requests.
## References
- **Vendor Advisory:** [https://www.veeam.com/kb4424](https://www.veeam.com/kb4424)
- **V12 Patch:** [https://www.veeam.com/kb4420](https://www.veeam.com/kb4420)
- **V11a Patch:** [https://www.veeam.com/kb4245](https://www.veeam.com/kb4245)
- **Huntress Blog:** [https://www.huntress.com/blog/veeam-backup-replication-cve-2023-27532-response](https://www.huntress.com/blog/veeam-backup-replication-cve-2023-27532-response)