CVE-2024-42019: Veeam One NTLM Hash Disclosure Vulnerability

CVE-2024-42019 Overview

CVE-2024-42019 is an information disclosure vulnerability in Veeam ONE that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. Exploitation requires user interaction and data previously collected from a Veeam Backup & Replication environment. The flaw is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Successful exploitation can enable NTLM relay attacks or offline password cracking against a privileged service account.

Critical Impact
An attacker who obtains the Veeam Reporter Service account NTLM hash can attempt authentication relay or credential cracking, leading to privileged access within the backup infrastructure.

Affected Products

Veeam ONE
Deployments integrating Veeam ONE with Veeam Backup & Replication
Environments where the Reporter Service runs under a domain account

Discovery Timeline

2024-09-07 - CVE-2024-42019 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-42019

Vulnerability Analysis

The vulnerability affects the Veeam Reporter Service component of Veeam ONE. An attacker with low-privilege network access can trick the service into exposing the NTLM hash of the account under which it runs. The attack path leverages data collected from Veeam Backup & Replication, which the attacker must first obtain or influence. Because the affected account is typically privileged within the backup environment, recovery of its NTLM hash undermines the trust boundary of the backup infrastructure.

The issue is classified as an information exposure weakness rather than a remote code execution flaw. However, NTLM hash disclosure is a well-documented stepping stone toward lateral movement, pass-the-hash, and NTLM relay attacks against Active Directory resources.

Root Cause

The root cause is insufficient protection of authentication material handled by the Veeam Reporter Service. The service can be induced to authenticate to an attacker-controlled endpoint using its own credentials. When the service performs outbound NTLM authentication in response to attacker-supplied input, the resulting NTLMv2 challenge-response can be captured and processed offline or relayed.

Attack Vector

Exploitation occurs over the network and requires low privileges plus user interaction. An authenticated user with access to Veeam ONE must be induced to trigger the vulnerable code path against data sourced from Veeam Backup & Replication. The attacker positions a listener that captures NTLM authentication material when the Reporter Service connects. Refer to the Veeam Knowledge Base Article KB4649 for vendor technical detail.

No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2024-42019

Indicators of Compromise

Outbound SMB or HTTP authentication attempts from the Veeam ONE Reporter Service host to unexpected internal or external destinations.
NTLM authentication events (Windows Event ID 4624 / 4776) originating from the Reporter Service account to non-Veeam infrastructure.
Unusual process activity or network sessions initiated by the Veeam Reporter Service outside normal reporting windows.

Detection Strategies

Monitor the Veeam ONE server for outbound NTLM authentication to hosts not part of the sanctioned Veeam or Active Directory topology.
Alert on any Responder-style capture patterns such as SMB requests to newly observed internal IP addresses from backup infrastructure.
Correlate Veeam ONE application logs with Windows security event logs to identify anomalous Reporter Service authentication flows.

Monitoring Recommendations

Enable NTLM auditing on the Veeam ONE server using Group Policy to log outgoing NTLM traffic.
Baseline normal network destinations for the Reporter Service account and alert on deviations.
Track privileged service account usage in a SIEM to detect pass-the-hash or relay follow-on activity.

How to Mitigate CVE-2024-42019

Immediate Actions Required

Apply the Veeam ONE update referenced in the Veeam Knowledge Base Article KB4649.
Rotate the NTLM credentials of the Veeam Reporter Service account after patching.
Restrict interactive and network logon rights for the Reporter Service account to only required hosts.
Review Veeam ONE user access and remove unnecessary low-privilege accounts that could satisfy the exploitation prerequisites.

Patch Information

Veeam has published remediation guidance in KB4649. Administrators should install the fixed Veeam ONE build referenced in that advisory. After updating, verify the Reporter Service is running under a least-privilege account and that its credential has been rotated to invalidate any previously captured hashes.

Workarounds

Configure the Reporter Service to run under a dedicated, non-privileged account with no domain administrative rights.
Enforce SMB signing and, where possible, disable NTLM in favor of Kerberos for authentication to Veeam infrastructure.
Segment the Veeam ONE and Veeam Backup & Replication hosts on a management network with strict egress filtering to block unauthorized authentication attempts.

bash

# Enable NTLM auditing on the Veeam ONE server (run as Administrator)
# Audits outgoing NTLM authentication so relay or capture attempts are logged.
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v AuditOutgoingNTLM /t REG_DWORD /d 2 /f