CVE-2024-22022: Veeam Recovery Orchestrator Disclosure Flaw

CVE-2024-22022 Overview

CVE-2024-22022 is an information disclosure vulnerability in Veeam Recovery Orchestrator. The flaw allows a user assigned a low-privileged role to access the NT LAN Manager (NTLM) hash of the service account running the Veeam Orchestrator Server Service. An authenticated attacker with limited access can retrieve credential material tied to a privileged Windows service account. Recovered NTLM hashes can be relayed or cracked offline, enabling lateral movement and privilege escalation across the Windows environment. Veeam addressed the issue in a security update documented in Veeam Knowledge Base KB4541. The vulnerability is tracked under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Low-privileged Veeam Recovery Orchestrator users can extract the NTLM hash of a privileged service account, enabling relay attacks, offline cracking, and lateral movement across the Windows domain.

Affected Products

Veeam Recovery Orchestrator (all versions prior to the fix in KB4541)
Veeam Orchestrator Server Service component
Deployments where the Orchestrator service runs under a domain service account

Discovery Timeline

2024-02-07 - CVE-2024-22022 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22022

Vulnerability Analysis

The vulnerability exposes the NTLM hash of the Windows service account used by the Veeam Orchestrator Server Service to any authenticated user, regardless of assigned role. Veeam Recovery Orchestrator implements role-based access control, but the exposed function did not properly restrict access to sensitive credential material. Low-privileged operators, who typically only manage restore plans or view reports, gain visibility into hashes that should be limited to administrators.

An attacker who obtains the NTLM hash can perform pass-the-hash attacks against other Windows systems accepting NTLM authentication. The attacker can also relay the hash to Active Directory services or attempt offline cracking to recover the plaintext password. Because Orchestrator service accounts frequently hold elevated privileges, such as local administrator on backup infrastructure, the impact extends beyond the Orchestrator host itself.

Root Cause

The root cause is missing authorization enforcement on an interface that returns cached or stored credential material. The application returns the NTLM hash to the requesting user without verifying that the caller holds an administrative role. This aligns with [CWE-200], where sensitive information is disclosed to an actor not explicitly authorized to receive it.

Attack Vector

Exploitation requires network access to the Veeam Recovery Orchestrator web interface and valid credentials for any Orchestrator user account. The attacker authenticates as a low-privileged user and then invokes the affected function to retrieve the service account hash. No user interaction and no additional privilege escalation is required to reach the vulnerable code path.

The vulnerability manifests in the Orchestrator role enforcement logic. See the Veeam Knowledge Base advisory for technical details and patched builds.

Detection Methods for CVE-2024-22022

Indicators of Compromise

Unexpected authentication events from the Orchestrator service account originating from hosts other than the Orchestrator server
NTLM authentication attempts against domain controllers using the Orchestrator service account outside of scheduled backup or recovery windows
Access to Orchestrator API endpoints or UI functions by non-administrator accounts that reference credential or account objects

Detection Strategies

Review Veeam Recovery Orchestrator audit logs for API calls made by low-privileged roles that touch credential-related endpoints
Correlate Orchestrator user sessions with subsequent NTLM authentication events involving the Orchestrator service account
Monitor for pass-the-hash tooling signatures on hosts accessible to the Orchestrator service account

Monitoring Recommendations

Enable Windows Event ID 4624 and 4625 logging on all systems where the Orchestrator service account has access and forward to a central SIEM
Alert on interactive or network logons from the Orchestrator service account to unexpected destinations
Track privileged service account usage baselines and flag deviations in source host, time, or authentication protocol

How to Mitigate CVE-2024-22022

Immediate Actions Required

Apply the update referenced in Veeam Knowledge Base KB4541 to all Veeam Recovery Orchestrator instances
Rotate the password of the service account used by the Veeam Orchestrator Server Service after patching
Audit all Veeam Recovery Orchestrator user accounts and remove roles or accounts that are no longer required

Patch Information

Veeam released a fixed build documented in Veeam Knowledge Base KB4541. Administrators should upgrade to the patched version and confirm the fix is present before reintroducing the service account into production authentication flows.

Workarounds

Restrict network access to the Veeam Recovery Orchestrator web interface to trusted management networks only
Limit membership of low-privileged Orchestrator roles until the patch is applied
Run the Veeam Orchestrator Server Service under a dedicated account with least privilege, avoiding domain administrator group membership

bash

# Rotate the Orchestrator service account password after patching (example)
net user svc_veeam_orchestrator * /domain

# Verify the Orchestrator service is configured with a least-privilege account
sc.exe qc "Veeam Orchestrator Server Service"