Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw

Proof-of-concept code to exploit a just-patched security hole in the Veeam Backup & Replication product has been published online.

Security researchers have published proof-of-concept (PoC) code that provides a roadmap to exploit a recently patched high-severity vulnerability in the Veeam Backup & Replication product

Earlier this month, Veeam released a patch for CVE-2023-27532 (CVSS score of 7.5), a security defect the company warned could be exploited to obtain encrypted credentials that are stored in the configuration database.

Successful exploitation of the issue, Veeam said, could allow an attacker to access the backup infrastructure hosts. Unpatched publicly exposed Veeam instances with a TCP port 9401 open could become easy targets to attackers.

A few days after Veeam’s patch release, anti-malware company Huntress said that there might be thousands of hosts running vulnerable versions of the solution, urging users to update their installations as soon as possible.

Patching is now critical, as Horizon3.ai has released proof-of-concept code targeting the flaw, along with a technical writeup of the vulnerability and the exploitation process.

“CVE-2023-27532 allows an unauthenticated user with access to the Veeam backup service to request cleartext credentials. We have examined the vulnerable port, reverse engineered the Veeam Backup Service, and constructed a WCF client using .NET core,” Horizon3.ai warned.

The vulnerability was addressed with the release of Veeam Backup & Replication versions 12 (build 12.0.0.1420 P20230223) and 11a (build 11.0.1.1261 P20230227), which need to be installed on the Veeam Backup & Replication server.

While there are no reports of CVE-2023-27532 being exploited in attacks, it might not be long before exploitation begins. Threat actors have been known to target Backup & Replication flaws in their attacks. 

Advertisement. Scroll to continue reading.

Veeam Backup & Replication is a backup solution for virtual environments that offers support for cloud-based workloads servers, and workstations, and for Hyper-V, Nutanix AHV, and vSphere virtual machines.

Related: Exploitation of Oracle E-Business Suite Flaw Starts After PoC Publication

Related: Exploitation of Control Web Panel Vulnerability Starts After PoC Publication

Related: PoC Code Published for High-Severity macOS Sandbox Escape Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.