Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw

Proof-of-concept code to exploit a just-patched security hole in the Veeam Backup & Replication product has been published online.

Security researchers have published proof-of-concept (PoC) code that provides a roadmap to exploit a recently patched high-severity vulnerability in the Veeam Backup & Replication product

Earlier this month, Veeam released a patch for CVE-2023-27532 (CVSS score of 7.5), a security defect the company warned could be exploited to obtain encrypted credentials that are stored in the configuration database.

Successful exploitation of the issue, Veeam said, could allow an attacker to access the backup infrastructure hosts. Unpatched publicly exposed Veeam instances with a TCP port 9401 open could become easy targets to attackers.

A few days after Veeam’s patch release, anti-malware company Huntress said that there might be thousands of hosts running vulnerable versions of the solution, urging users to update their installations as soon as possible.

Patching is now critical, as Horizon3.ai has released proof-of-concept code targeting the flaw, along with a technical writeup of the vulnerability and the exploitation process.

“CVE-2023-27532 allows an unauthenticated user with access to the Veeam backup service to request cleartext credentials. We have examined the vulnerable port, reverse engineered the Veeam Backup Service, and constructed a WCF client using .NET core,” Horizon3.ai warned.

The vulnerability was addressed with the release of Veeam Backup & Replication versions 12 (build 12.0.0.1420 P20230223) and 11a (build 11.0.1.1261 P20230227), which need to be installed on the Veeam Backup & Replication server.

Advertisement. Scroll to continue reading.

While there are no reports of CVE-2023-27532 being exploited in attacks, it might not be long before exploitation begins. Threat actors have been known to target Backup & Replication flaws in their attacks. 

Veeam Backup & Replication is a backup solution for virtual environments that offers support for cloud-based workloads servers, and workstations, and for Hyper-V, Nutanix AHV, and vSphere virtual machines.

Related: Exploitation of Oracle E-Business Suite Flaw Starts After PoC Publication

Related: Exploitation of Control Web Panel Vulnerability Starts After PoC Publication

Related: PoC Code Published for High-Severity macOS Sandbox Escape Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.