Veeam Backup Deserialization RCE (2024)
- Product
- Veeam Backup & Replication
- CVE
- CVE-2024-40711
- Disclosed
- 2024-09-04
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Veeam Backup & Replication 12.1.2.172 and all earlier version 12 builds.
- Fixed
- 12.2 (build 12.2.0.334).
Summary
An unauthenticated .NET deserialization bug in Veeam Backup & Replication reported by Florian Hauser (CODE WHITE). watchTowr published the details and ransomware crews (Akira, Fog, Frag) used it within weeks to create local admin accounts on backup servers.
Root cause
Veeam's .NET Remoting channel (running as SYSTEM) filters deserialized types with an allow-list, but the allowed class CDbCryptoKeyInfo deserializes nested data through a separate block-list path that was missing System.Runtime.Remoting.ObjRef, a known gadget. Builds up to 12.1.1.56 also accepted anonymous connections; 12.1.2.172 fixed that authorization check (leaving authenticated RCE), and 12.2.0.334 fixed the deserialization.
Impact
Unauthenticated RCE on the backup server, enabling backup deletion and lateral movement before ransomware deployment.
Detection
Check the Veeam build (Help > About). Look for net.exe spawned by Veeam.Backup.MountService / creation of local accounts named 'point' (observed by Sophos) and inbound connections to TCP/8000.
Mitigation
Upgrade to 12.2 or later; keep backup servers off the domain and unreachable from general networks.