CVE-2024-40712: Veeam Backup & Replication LPE Vulnerability

CVE-2024-40712 Overview

CVE-2024-40712 is a path traversal vulnerability affecting Veeam Backup & Replication that allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). This vulnerability enables malicious actors to escape intended directory restrictions and access sensitive system resources, ultimately gaining elevated privileges on compromised systems.

Critical Impact

Attackers with low-privileged local access can exploit this path traversal flaw to escalate privileges, potentially gaining full administrative control over Veeam Backup & Replication servers and the backup infrastructure they manage.

Affected Products

• Veeam Backup & Replication (vulnerable versions prior to security patch)

Discovery Timeline

• 2024-09-07 - CVE-2024-40712 published to NVD
• 2025-05-01 - Last updated in NVD database

Technical Details for CVE-2024-40712

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in Veeam Backup & Replication where improper neutralization of special elements in file paths allows attackers to traverse outside restricted directories. An authenticated local attacker with low privileges can manipulate file path inputs to access files and directories that should be restricted, enabling them to read, write, or execute files in arbitrary locations on the system.

The attack requires local access and low-level privileges, making it particularly dangerous in environments where multiple users have access to the Veeam server or in scenarios where an attacker has gained initial foothold through other means. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The vulnerability stems from improper input validation when processing file paths within Veeam Backup & Replication. The application fails to adequately sanitize user-supplied path components, allowing directory traversal sequences (such as ../) to escape the intended directory structure. This CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) weakness enables attackers to reference files outside the application's designated working directories.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to the system hosting Veeam Backup & Replication. The exploitation flow involves:

1. An attacker authenticates to the system with a low-privileged account
2. The attacker crafts malicious file path inputs containing directory traversal sequences
3. The vulnerable component processes these paths without proper sanitization
4. The attacker gains access to sensitive files or writes malicious content to privileged locations
5. Through strategic file manipulation, the attacker achieves privilege escalation to SYSTEM or Administrator level

The vulnerability can be exploited without user interaction once the attacker has local access, and the attack complexity is low, making it accessible to attackers with moderate technical skills.

Detection Methods for CVE-2024-40712

Indicators of Compromise

• Unusual file access patterns in Veeam Backup & Replication logs showing path traversal sequences (../, ..\\)
• Unexpected modifications to system files or configuration files outside Veeam directories
• New or modified files in sensitive system directories with timestamps correlating to Veeam process activity
• Privilege escalation events or new administrator accounts created following Veeam component execution

Detection Strategies

• Monitor Veeam Backup & Replication service accounts for unexpected privilege escalation or token manipulation
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Analyze Veeam application logs for malformed path requests or error messages indicating traversal attempts
• Deploy endpoint detection rules to identify process chains where Veeam components spawn unexpected child processes

Monitoring Recommendations

• Enable verbose logging for Veeam Backup & Replication services and centralize log collection
• Configure SIEM alerts for path traversal patterns in file access logs associated with Veeam processes
• Monitor for unusual process execution originating from Veeam service accounts with elevated privileges
• Implement behavioral analytics to detect anomalous file system access patterns by Veeam components

How to Mitigate CVE-2024-40712

Immediate Actions Required

• Apply the latest security patches from Veeam as detailed in knowledge base article KB4649
• Audit local user accounts with access to systems running Veeam Backup & Replication and remove unnecessary privileges
• Implement network segmentation to limit access to Veeam infrastructure components
• Review and restrict which users have local access to Veeam Backup & Replication servers

Patch Information

Veeam has released security updates to address this vulnerability. Administrators should refer to the Veeam Knowledge Base Article KB4649 for detailed patching instructions and affected version information. It is strongly recommended to upgrade to the latest patched version of Veeam Backup & Replication immediately.

Workarounds

• Restrict local access to Veeam Backup & Replication servers to only essential administrative personnel
• Implement the principle of least privilege for all accounts that interact with Veeam systems
• Deploy application whitelisting to prevent unauthorized executables from running on Veeam servers
• Monitor and audit all local authentication events on systems hosting Veeam Backup & Replication

# Audit local users with access to Veeam server
net localgroup "Users"
net localgroup "Administrators"

# Review Veeam service account permissions
sc qc VeeamBackupSvc
sc qc VeeamBrokerSvc