CVE-2024-29850: Veeam Backup Auth Bypass Vulnerability

CVE-2024-29850 Overview

CVE-2024-29850 is an authentication vulnerability in Veeam Backup Enterprise Manager that permits account takeover through NT LAN Manager (NTLM) relay attacks. The flaw is tracked under CWE-294: Authentication Bypass by Capture-replay and carries a CVSS v3.0 score of 8.8. An attacker positioned to intercept or coerce authentication traffic can relay NTLM credentials to the Enterprise Manager web interface and assume the identity of the victim account. Successful exploitation yields high impact to confidentiality, integrity, and availability of the backup management platform.

Critical Impact
Attackers can hijack privileged Veeam Backup Enterprise Manager accounts through NTLM relay, granting control over backup infrastructure and stored recovery data.

Affected Products

Veeam Backup & Replication (Veeam Backup Enterprise Manager component)
Deployments where Enterprise Manager is exposed to internal network authentication
Windows environments relying on NTLM authentication for Veeam management access

Discovery Timeline

2024-05-22 - CVE-2024-29850 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29850

Vulnerability Analysis

Veeam Backup Enterprise Manager accepts NTLM authentication without sufficient protections against credential relay. When a user or service account is coerced into authenticating to an attacker-controlled endpoint, the attacker can forward that NTLM challenge-response exchange to the Enterprise Manager service. The Enterprise Manager accepts the relayed authentication and issues a valid session for the impersonated account.

Exploitation requires user interaction, typically in the form of a triggered authentication attempt against an attacker-controlled host. Common triggers include phishing links, malicious file paths, or protocol coercion techniques such as PetitPotam or PrinterBug against domain services. The attack traverses the network without requiring prior credentials.

Once authenticated, the attacker inherits the privileges of the relayed identity within Enterprise Manager. Administrative sessions grant control over backup jobs, restore operations, and stored credentials, which are frequent targets for ransomware operators.

Root Cause

The vulnerability stems from the absence of NTLM relay protections such as Extended Protection for Authentication (EPA), channel binding, or enforced SMB/HTTP signing on the Enterprise Manager authentication endpoint [CWE-294]. Without these controls, the server cannot distinguish a legitimate client authentication from a relayed one.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker coerces NTLM authentication from a Veeam user or service account, relays it to the Enterprise Manager web interface, and receives a valid authenticated session bound to the victim identity.

No verified public exploit code has been released. Refer to the Veeam Knowledge Base Article KB4581 for vendor-provided technical guidance.

Detection Methods for CVE-2024-29850

Indicators of Compromise

Enterprise Manager authentication events originating from unexpected source IP addresses or hosts that do not typically administer Veeam.
NTLM authentication logs showing mismatches between the workstation name in the NTLM exchange and the actual connecting host.
Unusual creation, modification, or deletion of backup jobs, repositories, or credential entries shortly after a login event.

Detection Strategies

Correlate Windows Security Event ID 4624 (logon type 3, NTLM) on the Enterprise Manager server with expected administrative workstations and flag deviations.
Monitor IIS or Enterprise Manager web logs for authentication successes from atypical user agents or client addresses.
Alert on protocol coercion tooling patterns such as PetitPotam, Coercer, or Responder activity targeting hosts that hold Veeam service accounts.

Monitoring Recommendations

Forward Enterprise Manager, IIS, and domain controller authentication logs to a centralized analytics platform for cross-source correlation.
Baseline normal administrative access patterns and generate alerts when new accounts perform privileged Veeam operations.
Track outbound SMB and HTTP authentication attempts from Veeam servers to identify coercion attempts in progress.

How to Mitigate CVE-2024-29850

Immediate Actions Required

Apply the fixed Veeam Backup & Replication release identified in the Veeam Knowledge Base Article KB4581 as the primary remediation.
Restrict network access to the Enterprise Manager web interface so only authorized administrative subnets can reach it.
Rotate credentials for any Veeam service or administrator account that may have authenticated to untrusted endpoints.

Patch Information

Veeam has published guidance and fixed builds through KB4581. Administrators should upgrade Veeam Backup Enterprise Manager to the patched version referenced in that advisory and validate the deployment after upgrade.

Workarounds

Disable NTLM authentication in favor of Kerberos on the Enterprise Manager host where operationally feasible.
Enable Extended Protection for Authentication (EPA) and require HTTPS with channel binding on the Enterprise Manager IIS site.
Enforce SMB signing and LDAP signing across the domain to reduce broader NTLM relay exposure until patching is complete.

bash

# Enable Extended Protection for Authentication on the Enterprise Manager IIS site
# Run on the Veeam Enterprise Manager server in an elevated PowerShell prompt
Import-Module WebAdministration
Set-WebConfigurationProperty `
  -Filter "/system.webServer/security/authentication/windowsAuthentication/extendedProtection" `
  -Name "tokenChecking" -Value "Require" `
  -PSPath "IIS:\" -Location "VeeamBackup"
iisreset