CVE-2023-27532: 
Veeam Backup & Replication vulnerability analysis and mitigation

CVE-2023-27532 is a vulnerability discovered in Veeam Backup & Replication component that allows an unauthenticated user to retrieve encrypted credentials stored in the configuration database. The vulnerability was disclosed on March 7, 2023, affecting all versions prior to V12 (build 12.0.0.1420 P20230223) and V11a (build 11.0.1.1261 P20230227). The vulnerability specifically impacts the Veeam Backup & Replication and Veeam Cloud Connect products (Veeam KB).

The vulnerability exists in the Veeam.Backup.Service.exe process, which listens on TCP port 9401 by default. The service implements a Windows Communication Foundation (WCF) service that exposes an unauthenticated API endpoint. Through this endpoint, attackers can request and obtain encrypted credentials from the configuration database, which can then be decrypted using additional API calls (Horizon3). The vulnerability has been assigned a High severity rating with a CVSS v3 score of 7.5 (Veeam KB).

The exploitation of this vulnerability could lead to attackers gaining access to the backup infrastructure hosts. With access to the open TCP port 9401, any individual could obtain credentials and potentially move laterally throughout the network with the exposed usernames and passwords (Huntress).

Organizations should upgrade to Veeam Backup & Replication version 12 (build 12.0.0.1420 P20230223) or version 11a (build 11.0.1.1261 P20230227) or later. For systems using an all-in-one Veeam appliance with no remote backup infrastructure components, a temporary workaround is to block external connections to port TCP 9401 in the backup server firewall until the patch can be installed (Veeam KB).

Security researchers and organizations quickly responded to the vulnerability disclosure. CODE WHITE GmbH researchers demonstrated the vulnerability's severity through a proof-of-concept exploit. Huntress researchers conducted extensive analysis and proactively identified affected partners, sending incident reports to those running vulnerable versions (Huntress).