CVE-2024-39718
📋 TL;DR
An improper input validation vulnerability in Veeam software allows low-privileged authenticated users to remotely delete files on the system with the permissions of the service account. This affects Veeam Backup & Replication installations where users have access to the backup console. The vulnerability enables file deletion without proper authorization checks.
💻 Affected Systems
- Veeam Backup & Replication
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could delete critical system files, backup data, or configuration files, potentially causing data loss, service disruption, or system compromise.
Likely Case
Malicious or compromised low-privileged users deleting backup files, configuration files, or other data accessible to the Veeam service account.
If Mitigated
Limited impact with proper access controls, network segmentation, and monitoring in place to detect unauthorized file deletion attempts.
🎯 Exploit Status
Exploitation requires authenticated access to the Veeam console. The vulnerability involves improper input validation in file deletion functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 12.1.3.172 or later
Vendor Advisory: https://www.veeam.com/kb4649
Restart Required: Yes
Instructions:
1. Download Veeam Backup & Replication 12.1.3.172 or later from Veeam website. 2. Run the installer on the backup server. 3. Follow the upgrade wizard. 4. Restart the Veeam Backup Service after installation.
🔧 Temporary Workarounds
Restrict Console Access
allLimit access to Veeam console to only trusted administrators
Implement Least Privilege
allReview and minimize permissions for all Veeam console users
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the Veeam console
- Enable detailed logging and monitoring for file deletion activities
🔍 How to Verify
Check if Vulnerable:
Check Veeam Backup & Replication version in console: Help > About. If version is 12.1.2.172, system is vulnerable.Check Version:
In Veeam console: Navigate to Help > About to view versionVerify Fix Applied:
After patching, verify version shows 12.1.3.172 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in Veeam logs
- Multiple file deletion attempts by low-privileged users
- Failed authorization attempts for file operations
Network Indicators:
- Unusual traffic patterns to Veeam console from non-admin accounts
SIEM Query:
source="veeam_logs" AND (event_type="file_deletion" OR operation="delete") AND user_role!="administrator"