CVE-2024-45207: Veeam Agent For Windows RCE Vulnerability

CVE-2024-45207 Overview

CVE-2024-45207 is a DLL injection vulnerability affecting Veeam Agent for Windows. The vulnerability occurs when the system's PATH environment variable includes insecure locations. When the Veeam Agent runs, it searches directories specified in the PATH variable for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently, allowing the attacker to execute harmful code. This could lead to unauthorized access, data theft, or disruption of backup services.

Critical Impact
Successful exploitation allows attackers to execute arbitrary code within the context of the Veeam Agent process, potentially leading to unauthorized access, data exfiltration, or complete disruption of backup and recovery services.

Affected Products

Veeam Agent for Windows (all vulnerable versions prior to patch)

Discovery Timeline

2024-12-04 - CVE-2024-45207 published to NVD
2025-07-02 - Last updated in NVD database

Technical Details for CVE-2024-45207

Vulnerability Analysis

This vulnerability is classified as CWE-426 (Untrusted Search Path), a weakness where an application searches for critical resources in locations that may be under the control of malicious users. The Veeam Agent for Windows follows the standard Windows DLL search order when loading required dynamic link libraries. When the system's PATH environment variable contains directories that are writable by unprivileged users, an attacker can exploit this by placing a malicious DLL with a specific name in one of these insecure directories.

The attack requires local access to the system and the ability to write files to a directory that appears in the PATH before legitimate system directories. While the attack complexity is considered high due to these prerequisites, successful exploitation grants the attacker code execution with the same privileges as the Veeam Agent process, which typically runs with elevated permissions to perform backup operations.

Root Cause

The root cause of this vulnerability lies in the application's reliance on the system PATH environment variable for locating and loading DLL files without properly validating the source directories. When Veeam Agent for Windows initializes, it attempts to load certain DLLs by name. Windows follows a specific search order, and if the PATH includes directories that are writable by low-privileged users (such as user-controlled folders or improperly configured application directories), the application may inadvertently load a malicious DLL before finding the legitimate one.

Attack Vector

The attack vector is local, requiring an attacker to have authenticated access to the target system. The exploitation process involves identifying writable directories in the system PATH that are searched before the directories containing legitimate DLLs. The attacker then crafts a malicious DLL with the same name as one of the DLLs the Veeam Agent attempts to load during initialization or operation.

When the Veeam Agent service starts or performs certain operations, it inadvertently loads the attacker's malicious DLL, executing arbitrary code within the context of the Veeam process. This can result in privilege escalation if the Veeam Agent runs with elevated permissions, allowing the attacker to gain complete control over backup operations and potentially access sensitive data protected by the backup solution.

The vulnerability mechanism involves the Windows DLL search order behavior combined with insecure PATH configurations. An attacker with local access would identify DLL names loaded by the Veeam Agent, create a malicious DLL with the matching name, and place it in a writable directory that appears early in the PATH search order. For detailed technical information, refer to the Veeam Knowledge Base Article.

Detection Methods for CVE-2024-45207

Indicators of Compromise

Unexpected DLL files appearing in directories listed in the system PATH that are not standard system or application directories
DLL files with names matching known Veeam Agent dependencies located in user-writable directories
Anomalous process behavior from Veeam Agent services, including unexpected network connections or child processes
Modifications to the system PATH environment variable adding potentially insecure directories

Detection Strategies

Monitor file system events for DLL creation in directories that appear in the system PATH, particularly those writable by non-administrative users
Implement application whitelisting to detect and block loading of DLLs from untrusted locations
Use endpoint detection and response (EDR) solutions to monitor DLL loading patterns for Veeam Agent processes
Audit PATH environment variable changes across endpoints to identify potential attack setup activities

Monitoring Recommendations

Enable Windows Security Event logging for DLL load events (Event ID 7) with Sysmon
Configure file integrity monitoring for directories in the system PATH
Monitor Veeam Agent process execution patterns for deviations from baseline behavior
Implement alerting on any DLL loading from non-standard installation directories by backup-related processes

How to Mitigate CVE-2024-45207

Immediate Actions Required

Review and audit the system PATH environment variable on all systems running Veeam Agent for Windows
Remove or restrict write access to any user-writable directories that appear in the PATH before system directories
Apply the security patch provided by Veeam as documented in KB4693
Implement application control policies to prevent loading of unsigned or untrusted DLLs

Patch Information

Veeam has released a security update to address this vulnerability. Administrators should consult the Veeam Knowledge Base Article KB4693 for detailed patching instructions and the latest version information. The patch implements proper DLL loading practices to mitigate the untrusted search path vulnerability.

Workarounds

Ensure the system PATH environment variable only contains directories that are writable by administrators
Remove any user-writable directories from the PATH that precede legitimate system directories
Apply the principle of least privilege to directory permissions throughout the system
Consider using Windows Defender Application Control or similar solutions to restrict DLL loading to trusted sources

bash

# Audit system PATH for insecure directories
# PowerShell command to review PATH entries and their permissions
$env:Path -split ';' | ForEach-Object { 
    if (Test-Path $_) { 
        Get-Acl $_ | Select-Object Path, Owner, AccessToString 
    } 
}