CVE-2023-38547: Veeam ONE RCE Vulnerability

CVE-2023-38547 Overview

CVE-2023-38547 is a critical vulnerability in Veeam ONE that allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This information disclosure vulnerability can potentially lead to remote code execution on the SQL server hosting the Veeam ONE configuration database, making it a serious threat to enterprise backup infrastructure environments.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to obtain sensitive SQL server connection details, potentially enabling remote code execution on critical database infrastructure without any prior authentication.

Affected Products

• Veeam ONE 11.0.0.1379
• Veeam ONE 11.0.1.1880
• Veeam ONE 12.0.0.2498
• Veeam ONE 12.0.1.2591

Discovery Timeline

• 2023-11-07 - CVE-2023-38547 published to NVD
• 2025-03-06 - Last updated in NVD database

Technical Details for CVE-2023-38547

Vulnerability Analysis

This vulnerability stems from an information exposure weakness (CWE-200) in Veeam ONE's handling of SQL server connection information. The flaw allows unauthenticated remote attackers to access sensitive configuration data that reveals how Veeam ONE connects to its backend SQL server database.

The attack is network-accessible and requires no privileges or user interaction, making it particularly dangerous in environments where Veeam ONE is exposed to untrusted networks. Once an attacker obtains the SQL server connection details, they may be able to leverage this information to establish direct connections to the database server and potentially execute arbitrary code.

Veeam ONE is widely deployed in enterprise environments for monitoring and reporting on backup infrastructure. The configuration database contains critical operational data, and compromise of this database could impact the integrity of backup monitoring and potentially provide attackers with valuable reconnaissance information about an organization's backup topology.

Root Cause

The root cause of CVE-2023-38547 is improper access control over sensitive configuration information. Veeam ONE fails to adequately restrict access to SQL server connection details, allowing unauthenticated users to retrieve this information through network requests. This represents a failure to implement the principle of least privilege for sensitive database connection parameters.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker with network access to a vulnerable Veeam ONE instance can exploit this vulnerability by sending specially crafted requests to obtain SQL server connection information.

The exploitation chain typically involves:

1. Discovery of a vulnerable Veeam ONE instance on the network
2. Sending requests to extract SQL server connection details
3. Using the obtained credentials or connection strings to access the SQL server
4. Potential escalation to remote code execution on the SQL server through techniques such as xp_cmdshell or CLR assemblies

Since no verified exploit code is available, organizations should refer to the Veeam Knowledge Base Article for technical details regarding the vulnerability mechanism and patch information.

Detection Methods for CVE-2023-38547

Indicators of Compromise

• Unexpected network connections to Veeam ONE monitoring ports from untrusted sources
• Unusual SQL server authentication attempts originating from unexpected IP addresses
• Anomalous queries against the Veeam ONE configuration database
• Evidence of SQL server stored procedure execution such as xp_cmdshell following Veeam ONE access

Detection Strategies

• Monitor Veeam ONE web service logs for unauthenticated access attempts to configuration endpoints
• Implement network traffic analysis to detect reconnaissance activity against Veeam ONE instances
• Enable SQL Server audit logging to capture authentication attempts and query patterns from Veeam ONE database connections
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activity on SQL servers

Monitoring Recommendations

• Configure alerts for failed and successful authentication attempts to the SQL server hosting Veeam ONE configuration data
• Establish baseline network communication patterns for Veeam ONE and alert on deviations
• Monitor for execution of dangerous SQL Server extended stored procedures
• Implement SentinelOne Singularity platform for real-time threat detection across Veeam ONE servers and associated SQL infrastructure

How to Mitigate CVE-2023-38547

Immediate Actions Required

• Apply the security hotfix provided by Veeam immediately to all affected Veeam ONE installations
• Restrict network access to Veeam ONE instances to trusted management networks only
• Review SQL server access logs for any evidence of unauthorized access or suspicious activity
• Implement network segmentation to isolate backup infrastructure from general network traffic

Patch Information

Veeam has released security updates to address this vulnerability. Organizations should consult the Veeam Knowledge Base Article KB4508 for specific patch instructions and download links. The following versions are affected and require patching:

• Veeam ONE 11.0.0.1379
• Veeam ONE 11.0.1.1880
• Veeam ONE 12.0.0.2498
• Veeam ONE 12.0.1.2591

Workarounds

• Implement strict firewall rules to limit access to Veeam ONE only from authorized management workstations
• If patching is delayed, consider temporarily disabling external network access to Veeam ONE services
• Enable Windows Firewall rules on Veeam ONE servers to restrict incoming connections
• Configure SQL Server to require encrypted connections and implement IP-based access restrictions

# Example: Restrict Veeam ONE access using Windows Firewall
# Block external access to Veeam ONE default ports
netsh advfirewall firewall add rule name="Block Veeam ONE External Access" dir=in action=block protocol=tcp localport=1239,2805 remoteip=any

# Allow access only from management subnet
netsh advfirewall firewall add rule name="Allow Veeam ONE Management" dir=in action=allow protocol=tcp localport=1239,2805 remoteip=10.0.100.0/24