CVE-2024-42452: Veeam Backup Privilege Escalation Flaw

CVE-2024-42452 Overview

CVE-2024-42452 is an authorization flaw in Veeam Backup & Replication that lets a low-privileged user start an agent remotely in server mode. The agent then exposes credentials the attacker uses to escalate to system-level access on the backup server. Remote procedure calls bypass permission checks, allowing the attacker to upload files with elevated privileges. Full compromise of the backup infrastructure follows, giving attackers control over stored backups and connected workloads. The weakness maps to CWE-863: Incorrect Authorization.

Critical Impact
An authenticated low-privileged user can escalate to SYSTEM on the Veeam Backup & Replication server, harvest credentials, and upload arbitrary files.

Affected Products

Veeam Backup & Replication (see vendor advisory for fixed builds)
Veeam Backup Server components exposing the remote agent interface
Any environment where low-privileged Veeam users can reach the backup server over the network

Discovery Timeline

2024-12-04 - CVE-2024-42452 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42452

Vulnerability Analysis

The vulnerability resides in the remote agent control path of Veeam Backup & Replication. A low-privileged authenticated user can invoke a remote call that starts the agent in server mode. Once the agent runs in this mode, it discloses credentials to the caller. The attacker uses those credentials to authenticate to the backup server with elevated rights and upload files with SYSTEM-level privileges.

Because Veeam backup servers hold credentials for hypervisors, storage arrays, and domain resources, compromise expands the blast radius across the environment. Attackers can stage ransomware, exfiltrate backup data, or destroy recovery points to defeat restoration.

Root Cause

The root cause is missing authorization enforcement on remote procedure calls that control agent lifecycle and mode selection. The server trusts the caller's session without verifying that the requested action (starting an agent in server mode) is permitted for that role. This is a textbook CWE-863 authorization gap where authentication is validated but role-based access control is not.

Attack Vector

The attack requires network access to the Veeam Backup & Replication server and a valid low-privileged account. No user interaction is needed. The attacker issues a remote call to start the agent in server mode, receives credentials from the returned response or agent context, then authenticates using those credentials to perform privileged file uploads. Technical details are described in the Veeam Knowledge Base Article KB4693.

Detection Methods for CVE-2024-42452

Indicators of Compromise

Unexpected Veeam agent processes launched in server mode by non-administrative user sessions
Authentication events on the Veeam Backup server originating from service or backup accounts that normally do not interactively authenticate
New or modified files in Veeam installation directories or scheduled task locations following low-privileged user activity
Outbound connections from the Veeam Backup server to unfamiliar hosts shortly after suspicious agent starts

Detection Strategies

Monitor Windows Security event logs for logon events (Event ID 4624) using Veeam service accounts that correlate with prior low-privileged user activity
Alert on Veeam agent processes spawned with server-mode command-line arguments from non-admin contexts
Compare RPC and .NET Remoting traffic to the backup server against a baseline of expected administrative sources

Monitoring Recommendations

Enable verbose logging on the Veeam Backup & Replication server and forward logs to a centralized SIEM for correlation
Track file writes to C:\Program Files\Veeam\ and configuration directories, flagging changes outside patch windows
Baseline the accounts that legitimately invoke Veeam remote APIs and alert on deviations

How to Mitigate CVE-2024-42452

Immediate Actions Required

Apply the fixed build of Veeam Backup & Replication documented in the Veeam Knowledge Base Article KB4693
Audit Veeam user roles and remove accounts that do not require access to the backup server
Rotate all credentials stored within Veeam Backup & Replication after patching, including hypervisor, storage, and domain accounts
Restrict network access to the backup server so only administrative jump hosts can reach management ports

Patch Information

Veeam has published a fix in the vendor advisory. Review the Veeam Knowledge Base Article KB4693 for the exact fixed build number and upgrade procedure. Upgrade all Veeam Backup & Replication servers, including distributed components, to the patched version before re-enabling low-privileged user access.

Workarounds

Isolate the Veeam Backup & Replication server on a dedicated management network segment with strict firewall rules
Limit Veeam console and API access to a small set of administrator accounts protected by multi-factor authentication
Disable or remove unused low-privileged Veeam roles until the patch is deployed

bash

# Example: restrict inbound access to the Veeam Backup server management ports
# Replace <ADMIN_SUBNET> with your administrative network range
New-NetFirewallRule -DisplayName "Veeam Mgmt Restrict" `
  -Direction Inbound -Protocol TCP `
  -LocalPort 9392,9401,10001-10004 `
  -RemoteAddress <ADMIN_SUBNET> `
  -Action Allow

New-NetFirewallRule -DisplayName "Veeam Mgmt Block Others" `
  -Direction Inbound -Protocol TCP `
  -LocalPort 9392,9401,10001-10004 `
  -Action Block