CVE-2024-29851: Veeam Backup & Replication Hash Theft

CVE-2024-29851 Overview

CVE-2024-29851 affects Veeam Backup Enterprise Manager and allows a high-privileged user to steal the NTLM hash of the Enterprise Manager service account. The flaw is categorized under [CWE-294] Authentication Bypass by Capture-replay and stems from how the application handles authentication material. An attacker who already holds elevated privileges within Veeam Backup Enterprise Manager can coerce the service into disclosing NTLM credentials associated with its service account. Those credentials can then be relayed or cracked offline to expand access across the Windows environment.

Critical Impact
A high-privileged attacker can capture the NTLM hash of the Enterprise Manager service account, enabling lateral movement and potential domain compromise.

Affected Products

Veeam Backup & Replication (Veeam Backup Enterprise Manager component)
Veeam Backup Enterprise Manager versions prior to the patched release referenced in Veeam KB4581
Deployments where the Enterprise Manager service runs under a domain account

Discovery Timeline

2024-05-22 - CVE-2024-29851 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29851

Vulnerability Analysis

Veeam Backup Enterprise Manager is a web-based management console that centralizes control over Veeam Backup & Replication infrastructure. The service typically runs under a privileged Windows account with rights across backup infrastructure and Active Directory. The vulnerability allows an authenticated high-privileged user to force the Enterprise Manager service to authenticate to an attacker-controlled endpoint. During this coerced authentication, the service transmits an NTLM hash tied to its service account.

Once captured, the attacker can perform offline cracking against the hash or relay the authentication to another service that accepts NTLM. Because the service account often holds broad rights across backup, storage, and directory infrastructure, successful capture materially expands the attacker's control. The network attack vector and high impact on confidentiality, integrity, and availability reflect this downstream risk.

Root Cause

The root cause is improper validation of authentication targets in Enterprise Manager. The application permits an authenticated administrative user to trigger outbound authentication requests toward destinations the attacker controls. NTLM does not bind the authentication exchange to a specific expected server, so the service account credentials leak to any host that responds.

Attack Vector

Exploitation requires authenticated access to Veeam Backup Enterprise Manager as a high-privileged user. The attacker configures a rogue SMB or HTTP listener capable of capturing NTLM challenges and responses. They then use an Enterprise Manager function that initiates outbound authentication and direct it at the rogue listener. The captured NetNTLMv2 material is then cracked offline or relayed to services such as LDAP, SMB, or HTTP endpoints that permit NTLM. See the Veeam Knowledge Base Article for vendor technical details.

Detection Methods for CVE-2024-29851

Indicators of Compromise

Outbound SMB or HTTP authentication attempts from the Veeam Backup Enterprise Manager host to unexpected internal or external destinations.
Windows Security event 4624/4625 entries showing the Enterprise Manager service account authenticating to unusual hosts.
Configuration changes within Enterprise Manager that reference unfamiliar UNC paths or hostnames.
Presence of NTLM relay tooling such as Responder or ntlmrelayx on hosts adjacent to the Veeam infrastructure.

Detection Strategies

Baseline normal outbound authentication behavior of the Enterprise Manager host and alert on deviations to arbitrary SMB or HTTP endpoints.
Correlate Veeam application audit logs with Windows authentication logs to identify service-account authentication triggered by administrative user actions.
Alert on NTLM authentication attempts from the Veeam server to hosts outside the approved backup infrastructure inventory.

Monitoring Recommendations

Forward Veeam Enterprise Manager audit logs and Windows Security logs to a centralized analytics platform.
Monitor for new or modified administrative accounts within Veeam Backup Enterprise Manager.
Track process execution on the Veeam server for unexpected network utilities or credential-access tooling.

How to Mitigate CVE-2024-29851

Immediate Actions Required

Apply the Veeam Backup & Replication update referenced in the Veeam Knowledge Base Article to remediate CVE-2024-29851.
Audit and reduce the number of accounts holding administrative rights inside Veeam Backup Enterprise Manager.
Rotate the Enterprise Manager service account password and, where feasible, migrate the service to a Group Managed Service Account (gMSA).
Review recent Enterprise Manager audit logs for signs of coerced authentication before patching.

Patch Information

Veeam has released a fixed build of Veeam Backup & Replication that addresses CVE-2024-29851. Refer to the Veeam Knowledge Base Article for exact fixed versions, upgrade procedures, and post-installation validation steps. Restart the Veeam Backup Enterprise Manager service after applying the update and confirm the reported build matches the fixed release.

Workarounds

Restrict Veeam Backup Enterprise Manager administrative access to a small, audited group of operators using role-based access control.
Disable NTLM authentication where feasible or enforce SMB signing and Extended Protection for Authentication (EPA) on services that accept NTLM.
Segment the Veeam management network so the Enterprise Manager host cannot initiate outbound SMB or HTTP to arbitrary destinations.
Enforce multi-factor authentication for administrative logins to Veeam Backup Enterprise Manager.

bash

# Example: block outbound SMB from the Veeam Enterprise Manager host
# using Windows Defender Firewall (adjust profiles and IPs as needed)
New-NetFirewallRule -DisplayName "Block Outbound SMB (Veeam EM)" `
  -Direction Outbound -Protocol TCP -RemotePort 445 `
  -Action Block -Profile Any

# Verify current Veeam Backup & Replication build after patching
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication' |
  Select-Object CorePath, DatabaseVendor, SqlServerName