Veeam CVE-2023-27532 Enables Unauthenticated Credential Theft and Remote Code Execution
Summary
Huntress found over 7,500 hosts running vulnerable Veeam versions. CVE-2023-27532 could expose stored credentials and enable remote code execution; Huntress reported no observed exploitation and urged users to patch.
Key points
- The flaw affected Veeam Backup & Replication versions before V12 build 12.0.0.1420 P20230223 and V11a build 11.0.1.1261 P20230227.
- An unauthenticated attacker with access to the API on TCP port 9401 could retrieve encrypted credentials and use API calls to decrypt them.
- Huntress reproduced credential extraction and expanded its proof of concept to demonstrate arbitrary code execution.
- Huntress identified more than 7,500 vulnerable hosts among its install base and contacted affected partners.
- Huntress said it had not observed exploitation in the wild at the time of publication.
- The Veeam updates require a signed JSON Web Token for API requests and address the credential-dumping and remote-code-execution issues.
- Default logging does not record the relevant API calls; Huntress recommends setting the LoggingLevel registry value to 7 to capture them.
Article Details
- Vulnerability Types
- Unauthenticated credential disclosure
- Unauthenticated remote code execution
- Severity
- High; CVSS 7.5
- Affected Versions
- Veeam Backup & Replication versions prior to V12 (build 12.0.0.1420 P20230223)
- Veeam Backup & Replication versions prior to V11a (build 11.0.1.1261 P20230227)
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Block external connections to TCP port 9401 at the firewall.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0dcebe370ec61bd817ebeadcc827f7aadac3e5011f7a4e5967c50df85380074c | SHA-256 hash of the Veeam Backup & Replication 11.0.1.1261 ISO used to test the vulnerability and proof of concept; the article does not identify the ISO itself as malicious. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe proof of concept retrieves stored account credentials and decrypts them to their original plaintext values.T1021 · Remote ServicesThe article says exposed credentials could enable an attacker to move laterally to hosts and devices managed by the Veeam Backup server.T1210 · Exploitation of Remote ServicesThe vulnerability allows unauthenticated remote code execution against the vulnerable Veeam Backup & Replication server.