Adept disclosed Proof of Concept (PoC) exploit script for Veeam Backup Enterprise Manager vulnerability tagged as CVE-2024-29849. Apply the patch immediately!

Pierluigi Paganini
June 11, 2024

Publicly available is a demonstration of a Veeam Backup Enterprise Manager authentication bypass loophole, identified with the security label CVE-2024-29849.

Researcher Sina Kheirkha thoroughly investigated the Veeam Backup Enterprise Manager authentication bypass loophole CVE-2024-29849 and crafted a proof of concept exploit for this specific matter.

The vulnerability, marked as CVE-2024-29849, is a significant flaw (CVSS score: 9.8) within Veeam Backup Enterprise Manager, granting unauthorized individuals the ability to circumvent authentication protocols.

Veeam Backup Enterprise Manager functions as a centralized overseeing and reporting utility intended to streamline the management of Veeam Backup & Replication environments. It presents a web-based interface facilitating users to administer various Veeam Backup & Replication servers, scrutinize backup operations, and conceptualize reports.

“This susceptibility within Veeam Backup Enterprise Manager allows a non-authenticated threat actor to gain entry to the Veeam Backup Enterprise Manager web interface impersonating any user.” states the informative document issued by the manufacturer.

The flaw was rectified through the publication of version 12.1.2.172. The company also distributed the ensuing mitigation guidelines:

To eradicate this vulnerability, it is recommended to terminate the Veeam Backup Enterprise Manager software.
For accomplishing this, cease and deactivate the subsequent services:
- VeeamEnterpriseManagerSvc (Veeam Backup Enterprise Manager)
- VeeamRESTSvc (Veeam RESTful API Service)
  _{Note: It is essential not to disable the ‘Veeam Backup Server RESTful API Service’.}
Veeam Backup Enterprise Manager is compatible with the supervision of Veeam Backup & Replication servers running an earlier version than Veeam Backup Enterprise Manager. Therefore, if the Veeam Backup Enterprise Manager software is installed on a designated server, upgrading Veeam Backup Enterprise Manager to version 12.1.2.172 can be carried out without an immediate requirement to upgrade Veeam Backup & Replication.
Veeam Backup Enterprise Manager can be decommissioned if it is not in operational use.

It is strongly advised for administrators to swiftly apply the latest security updates owing to the presence of the Proof of Concept.

Kheirkha elucidated that the underlying cause is anchored within the ‘Veeam.Backup.Enterprise.RestAPIService.exe’ service (vVeeamRESTSvc ), which is established during the Veeam enterprise manager software setup.

“When delving into the heart of this vulnerability, I initially encountered a sense of disillusionment from the limited information provided by Veeam, merely hinting at the possibility of bypassing authentication measures, without putting forth substantial details. However, armed with the knowledge that the matter is connected to Authentication and the proposed remedy indicating that either the “VeeamEnterpriseManagerSvc” or “VeeamRESTSvc” services might be implicated, I commenced my patch analysis regimen and pinpointed the entry point, leading to the introduction of VeeamRESTSvc alias Veeam.Backup.Enterprise.RestAPIService.exe” as expounded in the written piece authored by the researcher.

The service operates on TCP port 9398 functioning as a REST API server, which essentially serves as an API variant of the primary web application operating on TCP port 9443

The exploit targets Veeam’s API by dispatching a meticulously crafted VMware single-sign-on (SSO) token to an exposed service. The specialist employed a token mimicking an administrator and delimited an SSO service URL that Veeam neglected to authenticate. Initially, the token undergoes base64 encoding, followed by decoding into XML and validation through a SOAP inquiry to a URL controlled by the assailant. Subsequently, a server under the attacker’s influence transmits an affirmative response to the validation, thereby providing the attacker with administrator privileges.

To detect any attempts at exploitation, it is advised by the researcher to scrutinize the subsequent log file:

C:ProgramDataVeeamBackupSvc.VeeamRestAPI.log

scan for Validating Single Sign-On token. Service enpoint URL:

Stay updated with the latest through my tweets: @securityaffairs, as well as on Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PoC exploit)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts