CVE-2024-42455: Veeam Backup Privilege Escalation Flaw

CVE-2024-42455 Overview

CVE-2024-42455 is an insecure deserialization vulnerability in Veeam Backup & Replication. A low-privileged authenticated user can connect to the product's remoting services and send a crafted serialized temporary file collection object. The deserialization routine relies on an insufficient blacklist, allowing dangerous types to pass through. Successful exploitation lets attackers delete any file on the system under the service account's privileges. Veeam disclosed the flaw and published guidance in Veeam Knowledge Base KB4693.

Critical Impact
An authenticated low-privileged attacker can delete arbitrary files on the Veeam Backup & Replication host, destroying backup data and disrupting recovery operations.

Affected Products

Veeam Backup & Replication (see vendor advisory for fixed build)
Deployments exposing remoting services to non-administrator accounts
Environments where the Veeam service account holds elevated file system rights

Discovery Timeline

2024-12-04 - CVE-2024-42455 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42455

Vulnerability Analysis

The flaw resides in the Veeam Backup & Replication remoting service, which accepts serialized .NET objects from authenticated clients. During deserialization the server enforces a type blacklist rather than a strict allowlist. The blacklist fails to cover a serialized temporary file collection gadget, which is reconstructed on the server side. When the object is materialized, its cleanup logic issues file deletion operations against paths controlled by the attacker.

Because the Veeam service typically runs with high privileges, the attacker inherits broad file system reach. Deletion of configuration files, database components, or backup chains can produce integrity and availability loss without touching confidentiality (C:N/I:H/A:H). The weakness is classified under [CWE-306: Missing Authentication for Critical Function], reflecting insufficient validation of caller intent during deserialization.

Root Cause

The deserialization pipeline uses a denylist to filter unsafe types. Denylists in .NET binary or SOAP deserialization routinely miss known gadget chains, and the temporary file collection type was not filtered. The gadget's finalizer or dispose method calls file delete APIs using attacker-controlled path strings.

Attack Vector

Exploitation requires network reachability to the Veeam remoting endpoint and a low-privileged account. The attacker constructs a serialized payload that instantiates the temporary file collection with target paths, then submits it through the remoting channel. On deserialization the server deletes the specified files with service account privileges. No user interaction is required.

No public proof-of-concept is available at time of writing. However, EPSS ranks this vulnerability in the top few percent for likelihood of exploitation, indicating high scanner and adversary interest.

Detection Methods for CVE-2024-42455

Indicators of Compromise

Unexpected file deletion events on the Veeam Backup & Replication server, particularly under directories owned by the Veeam service account
Authenticated remoting sessions from user accounts that do not normally administer the backup server
Missing or truncated backup metadata, catalog entries, or configuration files without a corresponding administrative action

Detection Strategies

Enable Windows object access auditing on Veeam program data, database, and backup repository paths and alert on delete operations by the Veeam service identity
Correlate remoting service authentication events with subsequent file system deletions on the same host within a short window
Baseline normal remoting client accounts and flag connections from previously unseen low-privileged identities

Monitoring Recommendations

Forward Veeam application logs, Windows Security event logs, and Sysmon file delete events (Event ID 23) to a central analytics platform
Track backup job failures and repository integrity checks as leading indicators of tampering
Alert on service restarts or catalog rebuilds initiated outside change windows

How to Mitigate CVE-2024-42455

Immediate Actions Required

Apply the fixed Veeam Backup & Replication build listed in Veeam KB4693
Restrict network access to the Veeam remoting service to administrative jump hosts only
Audit all Veeam user accounts and remove low-privileged users that do not require console or remoting access
Verify offline or immutable backup copies exist before patching, in case exploitation preceded remediation

Patch Information

Veeam addressed CVE-2024-42455 by tightening the deserialization filter in Veeam Backup & Replication. Consult the Veeam Knowledge Base Article KB4693 for the exact fixed build number and upgrade procedure. Apply the update on all backup servers, enterprise managers, and distributed components running the affected code path.

Workarounds

Place the Veeam Backup & Replication server on an isolated management network segment with strict firewall rules on remoting ports
Enforce least privilege on the Veeam service account so file deletion is bounded to required paths only
Require multi-factor authentication for any account authorized to reach Veeam management interfaces

bash

# Example: restrict inbound access to the Veeam remoting port with Windows Firewall
New-NetFirewallRule -DisplayName "Veeam Remoting - Admin Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9392 `
  -RemoteAddress 10.10.5.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "Veeam Remoting - Block Others" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9392 `
  -Action Block