On March 7, 2023, VEEAM published a vulnerability in its KB4424 affecting various software provided by the company. This vulnerability may lead to the disclosure of identifiers as well as to remote code execution.
VEEAM is a software company specialised in resilience for virtualisation infrastructures and cloud applications. Its flagship software, Veeam Backup & Replication, enables the backup of virtual machines, physical servers, cloud infrastructures and applications. Backups are stored in different types of storage destinations.
VEEAM usage at OVHcloud
At OVHcloud, there are several contexts in which VEEAM software can be used:
- The Veeam Backup Managed option for Hosted Private Cloud is based on Veeam solutions. As the solution is fully managed by OVHcloud, the necessary mitigations have been applied by OVHcloud.
- The Veeam Enterprise option of the Hosted Private Cloud product allows you to install and manage your own backup server. This means you get all the features of Veeam applications. In this option, OVHcloud allows you to obtain the Veeam licence and have a Pay-as-you-go billing. Server management and backup infrastructure security is therefore the responsibility of our customer.
- Installation of a backup server with your own licenses. In this mode, you have full control over your entire backup infrastructure.
In the latter two modes, you can add Hosted Private Cloud, dedicated servers, and other services to your backup solution.
CVE-2023-27532 affecting the listening process on port 9401 of the VEEAM server allows an unauthenticated attacker to extract credentials stored in the solution database and trigger the execution of arbitrary commands on the backup server. The attacker can then potentially use this information to gain access to the servers and infrastructure covered by the backup system and take control of the server running the Veeam service.
Scenario d'operation
The vulnerability, even if its exploitation is not trivial, is actively exploited by at least one ransomware group, and several exploitation codes are publicly available. It is therefore to be feared that automated attacks will multiply in the coming weeks.
The observed exploitation scenario consists of deploying an executable on the VEEAM server in order to retrieve the identifiers of the backed up infrastructure (vSphere access code, etc.), delete the currently running virtual machines, and finally encrypt the backups while demanding a ransom. So far we have identified this scenario only on Windows systems where Veeam could be installed with port 9401 exposed to the Internet.
How do I know if my service is vulnerable
All versions of Veeam Backup & Replication prior to 12.0.0.1420 P20230223 or 11.0.1.1261 P20230227 are vulnerable. If port 9401 is accessible from untrusted IP addresses, the service is vulnerable.
Risk Resolution and Mitigation
To protect against this attack, an update to the backup infrastructure is required. You will find the corrected binaries in the official article published by VEEAM.
While you are waiting for your infrastructure to be updated, we recommend that you implement the following measures:
For backup servers, we recommend that you avoid exposing them to unsecured networks (e.g.: Public networks).
By default, the VEEAM installation configures the Windows firewall to allow all incoming connections on the ports used by the solution.
We recommend that you apply filtering rules to restrict the exposed services to a minimum.
To do this, make sure that the Windows firewall on your backup server is enabled and configured to block incoming connections that do not match any rules.
Then ensure that the ports used are only accessible from servers in your infrastructure. For optimal filtering you can refer to the official documentation.
You should now see the filtering rule restricted to your network
If you are not using a mount server, we recommend blocking port 9401 completely, or restricting it only from the address of the mount server(s). More generally, we recommend that you block all the services you do not use.
At the level of the virtualization infrastructure or destination storages, no mitigation is conceivable. The attacker using legitimate connections, it is not possible to prevent them. It is therefore essential to secure any component connecting to these services.
In the event of a compromise
If you suspect a compromise related to this attack, we recommend that you contact support as soon as possible to evaluate the solutions available to you to recover your data.
Additional references:
https://www.veeam.com/kb4424
https://helpcenter.veeam.com/docs/backup/vsphere/used_ports.html?ver=120
https://www.ovhcloud.com/en-gb/enterprise/products/hosted-private-cloud/
https://www.ovhcloud.com/fr/enterprise/products/hosted-private-cloud/veeam-backup-managed/
https://www.ovhcloud.com/en-gb/storage-solutions/veeam-enterprise/