CVE-2023-38547: Veeam ONE Information Disclosure Flaw

CVE-2023-38547 Overview

CVE-2023-38547 is an information disclosure vulnerability in Veeam ONE that exposes details about the SQL server connection used by Veeam ONE to reach its configuration database. An unauthenticated remote attacker can query the affected service to retrieve connection metadata. This metadata can be leveraged to reach the underlying SQL server, potentially leading to remote code execution on the host running the configuration database. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Veeam published Knowledge Base article KB4508 describing affected builds and remediation.

Critical Impact
Unauthenticated attackers can extract SQL connection details from Veeam ONE and pivot to remote code execution on the SQL server hosting the configuration database.

Affected Products

Veeam ONE 11.0.0.1379
Veeam ONE 11.0.1.1880
Veeam ONE 12.0.0.2498 and 12.0.1.2591

Discovery Timeline

2023-11-07 - CVE-2023-38547 published to the National Vulnerability Database
2025-03-06 - Last updated in NVD database

Technical Details for CVE-2023-38547

Vulnerability Analysis

Veeam ONE exposes a network-reachable service that returns information about the SQL server connection used for its configuration database. The service does not require authentication before returning these details. An attacker on the network can interact with the exposed endpoint to learn the SQL server hostname, instance, and the credential or authentication context Veeam ONE uses. With this information, the attacker can target the SQL server directly. Where the leaked credentials grant elevated SQL privileges, the attacker can enable xp_cmdshell or abuse other procedures to execute operating system commands on the SQL host. The chain converts an information disclosure into full remote code execution on critical backup infrastructure.

Root Cause

The root cause is improper access control on a Veeam ONE component that returns sensitive configuration data. The service classifies SQL connection metadata as queryable without first validating the caller. This aligns with CWE-200, exposure of sensitive information to an unauthorized actor. Connection metadata for a backend datastore should not be reachable by unauthenticated principals on the network.

Attack Vector

Exploitation requires only network access to the Veeam ONE host. No user interaction or prior credentials are needed. An attacker sends crafted requests to the vulnerable service, parses the returned SQL connection information, and then authenticates to the SQL server using the disclosed context. Public proof-of-concept exploit code is not currently catalogued, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS percentile sits in the top tier of likely-exploited issues, indicating elevated risk. Refer to the Veeam KB4508 advisory for vendor-confirmed technical scope.

Detection Methods for CVE-2023-38547

Indicators of Compromise

Unexpected inbound network connections to Veeam ONE management ports from non-administrative hosts or external addresses.
Anomalous SQL authentication events on the configuration database server originating from hosts other than the Veeam ONE application server.
Execution of xp_cmdshell, sp_OACreate, or other command-execution stored procedures on the configuration database SQL instance.
Spawned child processes such as cmd.exe or powershell.exe under the SQL Server service account (sqlservr.exe).

Detection Strategies

Inventory all Veeam ONE deployments and compare installed builds against the fixed versions listed in Veeam KB4508.
Enable SQL Server audit logging for successful and failed logins on the Veeam ONE configuration database and forward events to a centralized SIEM.
Hunt for outbound SQL traffic originating from unexpected source hosts targeting the configuration database server.

Monitoring Recommendations

Alert on any process creation under the SQL Server service account that is not part of normal database operation.
Monitor Veeam ONE service logs for repeated requests to information-returning endpoints from non-administrative subnets.
Track changes to SQL Server configuration options such as xp_cmdshell and Ole Automation Procedures being enabled at runtime.

How to Mitigate CVE-2023-38547

Immediate Actions Required

Upgrade Veeam ONE to the patched build referenced in Veeam KB4508 on every monitoring server, client console, and reporting service host.
Restrict network access to the Veeam ONE server using firewall rules so that only administrative workstations can reach management ports.
Rotate the SQL credentials used by Veeam ONE for the configuration database after patching, in case the connection context was disclosed.

Patch Information

Veeam released fixed builds for Veeam ONE versions 11 and 12. Administrators must apply the hotfix on the Veeam ONE Server, Veeam ONE Web Client, and Veeam ONE Reporting Service components per the procedure in Veeam KB4508. Patching the Veeam ONE Server alone is not sufficient.

Workarounds

If immediate patching is not possible, isolate the Veeam ONE server behind a host firewall that only allows traffic from authorized administrative hosts.
Disable xp_cmdshell and Ole Automation Procedures on the SQL Server instance hosting the Veeam ONE configuration database to limit post-exploitation impact.
Ensure the SQL account used by Veeam ONE is granted the minimum privileges required, with no sysadmin membership where not strictly necessary.

bash

# Disable xp_cmdshell on the configuration database SQL instance
sqlcmd -S <sql-host> -E -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"