Veeam Backup Service Credential Leak

Product: Veeam Backup & Replication
CVE: CVE-2023-27532
Disclosed: 2023-03-07
CVSS: 7.5
Auth: pre-auth
CISA KEV: yes
Affected: Veeam Backup & Replication 12 before build 12.0.0.1420 P20230223 and 11 before 11.0.1.1261 P20230227 (and older versions).
Fixed: 12.0.0.1420 P20230223, 11a 11.0.1.1261 P20230227.

Summary

The Veeam Backup Service on TCP/9401 exposed a WCF endpoint that returned stored credentials without authentication. Ransomware groups such as FIN7 and Cuba used it to dump cleartext passwords and run commands on backup servers.

Root cause

The Veeam Backup Service exposes a WCF (NetTcpBinding) IRemoteInvokeService interface on TCP/9401 that accepted unauthenticated calls. CredentialsDbScopeGetAllCreds lists stored credential IDs and CredentialsDbScopeFindCredentials returns each credential, giving cleartext usernames and passwords. Rapid7 showed the same interface can also be abused to run commands as SYSTEM.

Impact

Cleartext credentials for backup infrastructure hosts, leading to code execution on the backup server and the ability to destroy backups before ransomware deployment.

Public PoC

# leak plaintext credentials from the remote server
VeeamHax.exe --target 192.168.0.100

# run an arbitrary command as SYSTEM on the remote server
VeeamHax.exe --target 192.168.0.100 --cmd calc.exe

Source: sfewer-r7 - VeeamHax (CVE-2023-27532)

Detection

Scan for TCP/9401 (nmap -p9401). Review Veeam logs (C:\ProgramData\Veeam\Backup\Svc.VeeamBackup.log) for calls to CredentialsDbScopeGetAllCreds from unexpected hosts.

Mitigation

Upgrade; if not possible, block external access to TCP/9401 on the backup server firewall.