CVE-2021-35971: Veeam Backup Deserialization Vulnerability

CVE-2021-35971 Overview

CVE-2021-35971 is an insecure deserialization vulnerability affecting Veeam Backup and Replication software. The vulnerability exists in how the application handles deserialization during Microsoft .NET remoting operations. An attacker exploiting this flaw could potentially execute arbitrary code on affected systems without requiring authentication, making it a significant threat to enterprise backup infrastructure.

Critical Impact

Unauthenticated remote code execution via insecure deserialization in .NET remoting could allow attackers to completely compromise backup and replication infrastructure, potentially leading to data exfiltration or ransomware deployment.

Affected Products

• Veeam Backup & Replication 10 before version 10.0.1.4854 P20210609
• Veeam Backup & Replication 11 before version 11.0.0.837 P20210507

Discovery Timeline

• 2021-06-30 - CVE CVE-2021-35971 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-35971

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a well-known class of security weaknesses that allows attackers to inject malicious serialized objects into application data streams. In Veeam Backup and Replication, the .NET remoting functionality fails to properly validate or sanitize deserialized data, enabling exploitation by remote attackers.

The network-accessible nature of this vulnerability means that an attacker with network access to the Veeam services can craft malicious payloads that, when deserialized by the application, result in arbitrary code execution. The attack requires no privileges or user interaction, making it highly exploitable in environments where Veeam services are exposed on the network.

Root Cause

The root cause stems from improper handling of deserialization within Microsoft .NET remoting components used by Veeam Backup and Replication. When the application receives serialized .NET objects via remoting channels, it deserializes them without adequate validation of the object types or content. This allows an attacker to craft specially designed serialized payloads containing malicious code that executes during the deserialization process.

.NET deserialization vulnerabilities are particularly dangerous because they can leverage "gadget chains" - sequences of existing code within the application or its dependencies that can be chained together to achieve arbitrary code execution when triggered by a malicious serialized object.

Attack Vector

The attack is conducted over the network against Veeam Backup and Replication services that utilize .NET remoting. An attacker can send crafted serialized objects to the exposed remoting endpoints. When the server deserializes these objects, the malicious payload executes with the privileges of the Veeam service, which typically runs with elevated permissions to perform backup operations.

The exploitation workflow involves:

1. Identifying network-exposed Veeam remoting services
2. Crafting a malicious serialized .NET object containing an exploitation gadget chain
3. Sending the payload to the vulnerable remoting endpoint
4. Achieving code execution when the server deserializes the malicious object

This vulnerability does not require authentication, making it particularly dangerous for organizations with Veeam services accessible from untrusted networks.

Detection Methods for CVE-2021-35971

Indicators of Compromise

• Unexpected outbound network connections from Veeam Backup server processes
• Unusual child processes spawned by Veeam service executables
• Suspicious .NET remoting traffic patterns or malformed serialization data in network logs
• Unexpected file modifications or new executables in Veeam installation directories

Detection Strategies

• Monitor network traffic to Veeam remoting ports for anomalous serialized object patterns
• Implement application whitelisting to detect unauthorized processes spawned by Veeam services
• Deploy endpoint detection solutions capable of identifying .NET deserialization exploitation techniques
• Audit Veeam service accounts for unexpected privilege escalation or lateral movement activities

Monitoring Recommendations

• Enable detailed logging for Veeam Backup and Replication services and forward logs to SIEM
• Configure network monitoring for unusual traffic volumes or patterns to Veeam server ports
• Implement file integrity monitoring on Veeam installation directories
• Set up alerts for process execution anomalies involving Veeam service accounts

How to Mitigate CVE-2021-35971

Immediate Actions Required

• Upgrade Veeam Backup & Replication 10 to version 10.0.1.4854 P20210609 or later
• Upgrade Veeam Backup & Replication 11 to version 11.0.0.837 P20210507 or later
• Restrict network access to Veeam remoting services using firewall rules
• Review system logs for any signs of exploitation prior to patching

Patch Information

Veeam has released patches addressing this vulnerability. Organizations should apply the appropriate cumulative patch for their version:

• For Veeam Backup & Replication 10: Apply cumulative patch P20210609 (version 10.0.1.4854) or later
• For Veeam Backup & Replication 11: Apply cumulative patch P20210507 (version 11.0.0.837) or later

Detailed patch information and download links are available in Veeam Knowledge Base Article #4126 and Veeam Knowledge Base Article #4180.

Workarounds

• Isolate Veeam Backup servers on dedicated network segments with restricted access
• Implement network-level controls to limit access to Veeam remoting ports to authorized management systems only
• Deploy network intrusion prevention systems (IPS) with signatures for .NET deserialization attacks
• Consider disabling remote management features if not required until patches can be applied

# Example: Restrict network access to Veeam services using Windows Firewall
# Limit access to known management IP addresses only
netsh advfirewall firewall add rule name="Restrict Veeam Remoting" dir=in action=allow protocol=tcp localport=9392 remoteip=192.168.1.100/32
netsh advfirewall firewall add rule name="Block Veeam Remoting Default" dir=in action=block protocol=tcp localport=9392