Article Details

Exploit for critical Veeam auth bypass available, patch now. A proof-of-concept (PoC) exploit for a Veeam Backup Enterprise Manager authentication bypass flaw tracked as CVE-2024-29849 is now publicly available, making it urgent that admins apply the latest security updates. Veeam Backup Enterprise Manager (VBEM) is a web-based platform for managing Veeam Backup & Replication installations via a web console. It helps control backup jobs and perform restoration operations across an organization's backup infrastructure and large-scale deployments. Veeam issued a security bulletin about the critical flaw on May 21, warning about a critical vulnerability enabling remote unauthenticated attackers to log in to VBEM's web interface as any user. The vendor urged its customers to address the problem by upgrading to VBEM version 12.1.2.172, while also sharing mitigation tips for those unable to apply the update immediately. Exploit details In a technical writeup by Sina Kheirkha, the cybersecurity researcher explains that the flaw lies in the 'Veeam.Backup.Enterprise.RestAPIService.exe' service, which listens on TCP port 9398, functioning as a REST API server for the main web application. The exploit involves sending a specially crafted VMware single-sign-on (SSO) token to the vulnerable service using the Veeam API. The token contains an authentication request that impersonates an administrator user and an SSO service URL that Veeam, crucially, doesn't verify. The base64-encoded SSO token is decoded and interpreted in XML form to verify its validity via a SOAP request to an attacker-controlled URL. This rogue server set up by the attacker responds positively to validation requests, so Veeam accepts the authentication request and gives administrator access to the attacker. The provided exploit demonstrates all the steps to exploit the vulnerability, including setting up a callback server, sending the crafted token, and retrieving a list of file servers as proof of successful exploitation. Addressing the risks Although no in-the-wild exploitation of CVE-2024-29849 has been reported yet, the public availability of a working exploit could change this in a short time. Therefore, updating to version 12.1.2.172 or later as soon as possible is critical. Those unable to patch should follow these recommendations: