Summary
Veeam heeft kwetsbaarheden verholpen in diverse producten, zoals Backup & Replication, ONE, Service Provider Console en Agent.
Details
Interpretaties
UPDATE: Er is inmiddels POC code online beschikbaar en CVE-2024-40711 is recentelijk actief misbruikt om ransomware uit te rollen.
Een kwaadwillende kan de kwetsbaarheden misbruiken om beveiligingsmaatregelen te omzeilen, zichzelf verhoogde rechten toe te kennen en willekeurige code uit te voeren met rechten van de applicatie.
De ernstigste kwetsbaarheid bevindt zich in Backup & Replication en heeft kenmerk CVE-2024-40711 toegewezen gekregen en stelt een ongeauthenticeerde kwaadwillende in staat om willekeurige code uit te voeren met rechten van de applicatie. Voor succesvol misbruik moet de kwaadwillende wel toegang hebben tot het kwetsbare systeem. Het is goed gebruik een dergelijke Backup & Recovery-oplossing niet publiek toegankelijk te hebben.
Oplossingen
Veeam heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de getroffen producten. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 17
-
Critical 9.8
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…
KEV Oct 17, 2024 -
Critical 9.9
An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account o…
-
Critical 9.9
A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to r…
-
Critical 9.1
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform rem…
-
Critical 9.0
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This att…
-
High 8.8
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service…
-
High 8.8
A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through …
-
High 8.5
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead t…
-
High 8.5
A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitr…
-
High 8.3
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network t…
-
High 8.1
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system wit…
-
High 7.8
A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to…
-
High 7.8
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perfo…
-
High 7.8
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alt…
-
High 7.5
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
-
High 7.5
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.
-
High 7.3
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.
Revision history
-
#1
POC code beschikbaar, actief misbruik bekend.
-
#0
Initiele versie
References
-
Reference - certbundde; cveprojectv5; ncscclear; nvd
https://www.veeam.com/kb4649
-
Reference - ncscclear
https://infosec.exchange/@SophosXOps/113284564225476186
-
Reference - ncscclear
https://www.bleepingcomputer.com/news/security/akira-and-fog-ransomware-now-exploiting-critical-veeam-rce-flaw/