Veeam Backup & Replication Encrypted Credentials Disclosure

Dataprise Defense Digest

ID: D3-2023-0004-1

Severity: HIGH (7.5)

Published: March, 9^th 2023

EXECUTIVE SUMMARY

Veeam has disclosed a vulnerability within their Veeam® Backup & Replication™ component that could allow an unauthenticated user to request encrypted credentials that could lead to them gaining access to backup infrastructure hosts. This affects all Veeam Backup & Replication versions. Patches are available for V11 and V12 to mitigate this vulnerability.

Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analysis of these vulnerabilities and the potential impact to our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions. If your organization’s Veeam appliance is covered under a service agreement, we will send a follow-up communication with details on our mitigation efforts

IMPACT

Vulnerability CVE-2023-27532 in a Veeam® Backup & Replication™ component allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

DETAILED ANALYSIS

The vulnerable process, Veeam.Backup.Service.exe (TCP 9401 by default), allows an unauthenticated user to request encrypted credentials.

MITIGATION STEPS

This vulnerability is resolved in the following Veeam Backup & Replication build numbers:

• 12 (build 12.0.0.1420 P20230223)
• 11a (build 11.0.1.1261 P20230227)

NOTE: Dataprise does not yet support v12, upgrading to v12 will break your cloud backups.

If you use an all-in-one Veeam appliance with no remote backup infrastructure components, you can alternatively, block external connections to port TCP 9401 in the backup server firewall as a temporary remediation until the patch is installed.

SOURCES

• https://www.veeam.com/kb4424
• https://www.veeam.com/kb4420
• https://www.veeam.com/kb4245

CONTRIBUTING AUTHORS

• Stephen Jones, VP, Cybersecurity
• Steven New, Director, BCDR
• Kelly Cullwell, Senior Manager, Service Transition

View all Dataprise Defense Digests here.