CVE-2024-45207: Veeam Agent For Windows RCE Vulnerability

CVE-2024-45207 Overview

CVE-2024-45207 is a DLL injection vulnerability affecting Veeam Agent for Windows. The vulnerability occurs when the system's PATH environment variable includes insecure locations. When the Veeam Agent runs, it searches directories specified in the PATH variable for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently, allowing the attacker to execute harmful code. This could lead to unauthorized access, data theft, or disruption of backup services.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code within the context of the Veeam Agent process, potentially leading to unauthorized access, data exfiltration, or complete disruption of backup and recovery services.

Affected Products

• Veeam Agent for Windows (all vulnerable versions prior to patch)

Discovery Timeline

• 2024-12-04 - CVE-2024-45207 published to NVD
• 2025-07-02 - Last updated in NVD database

Technical Details for CVE-2024-45207

Vulnerability Analysis

This vulnerability is classified as CWE-426 (Untrusted Search Path), a weakness where an application searches for critical resources in locations that may be under the control of malicious users. The Veeam Agent for Windows follows the standard Windows DLL search order when loading required dynamic link libraries. When the system's PATH environment variable contains directories that are writable by unprivileged users, an attacker can exploit this by placing a malicious DLL with a specific name in one of these insecure directories.

The attack requires local access to the system and the ability to write files to a directory that appears in the PATH before legitimate system directories. While the attack complexity is considered high due to these prerequisites, successful exploitation grants the attacker code execution with the same privileges as the Veeam Agent process, which typically runs with elevated permissions to perform backup operations.

Root Cause

The root cause of this vulnerability lies in the application's reliance on the system PATH environment variable for locating and loading DLL files without properly validating the source directories. When Veeam Agent for Windows initializes, it attempts to load certain DLLs by name. Windows follows a specific search order, and if the PATH includes directories that are writable by low-privileged users (such as user-controlled folders or improperly configured application directories), the application may inadvertently load a malicious DLL before finding the legitimate one.

Attack Vector

The attack vector is local, requiring an attacker to have authenticated access to the target system. The exploitation process involves identifying writable directories in the system PATH that are searched before the directories containing legitimate DLLs. The attacker then crafts a malicious DLL with the same name as one of the DLLs the Veeam Agent attempts to load during initialization or operation.

When the Veeam Agent service starts or performs certain operations, it inadvertently loads the attacker's malicious DLL, executing arbitrary code within the context of the Veeam process. This can result in privilege escalation if the Veeam Agent runs with elevated permissions, allowing the attacker to gain complete control over backup operations and potentially access sensitive data protected by the backup solution.

The vulnerability mechanism involves the Windows DLL search order behavior combined with insecure PATH configurations. An attacker with local access would identify DLL names loaded by the Veeam Agent, create a malicious DLL with the matching name, and place it in a writable directory that appears early in the PATH search order. For detailed technical information, refer to the Veeam Knowledge Base Article.

Detection Methods for CVE-2024-45207

Indicators of Compromise

• Unexpected DLL files appearing in directories listed in the system PATH that are not standard system or application directories
• DLL files with names matching known Veeam Agent dependencies located in user-writable directories
• Anomalous process behavior from Veeam Agent services, including unexpected network connections or child processes
• Modifications to the system PATH environment variable adding potentially insecure directories

Detection Strategies

• Monitor file system events for DLL creation in directories that appear in the system PATH, particularly those writable by non-administrative users
• Implement application whitelisting to detect and block loading of DLLs from untrusted locations
• Use endpoint detection and response (EDR) solutions to monitor DLL loading patterns for Veeam Agent processes
• Audit PATH environment variable changes across endpoints to identify potential attack setup activities

Monitoring Recommendations

• Enable Windows Security Event logging for DLL load events (Event ID 7) with Sysmon
• Configure file integrity monitoring for directories in the system PATH
• Monitor Veeam Agent process execution patterns for deviations from baseline behavior
• Implement alerting on any DLL loading from non-standard installation directories by backup-related processes

How to Mitigate CVE-2024-45207

Immediate Actions Required

• Review and audit the system PATH environment variable on all systems running Veeam Agent for Windows
• Remove or restrict write access to any user-writable directories that appear in the PATH before system directories
• Apply the security patch provided by Veeam as documented in KB4693
• Implement application control policies to prevent loading of unsigned or untrusted DLLs

Patch Information

Veeam has released a security update to address this vulnerability. Administrators should consult the Veeam Knowledge Base Article KB4693 for detailed patching instructions and the latest version information. The patch implements proper DLL loading practices to mitigate the untrusted search path vulnerability.

Workarounds

• Ensure the system PATH environment variable only contains directories that are writable by administrators
• Remove any user-writable directories from the PATH that precede legitimate system directories
• Apply the principle of least privilege to directory permissions throughout the system
• Consider using Windows Defender Application Control or similar solutions to restrict DLL loading to trusted sources

# Audit system PATH for insecure directories
# PowerShell command to review PATH entries and their permissions
$env:Path -split ';' | ForEach-Object { 
    if (Test-Path $_) { 
        Get-Acl $_ | Select-Object Path, Owner, AccessToString 
    } 
}