CVE-2024-52945 Overview
CVE-2024-52945 is a DLL hijacking vulnerability in Veritas NetBackup versions before 10.5 running on Windows. The flaw affects NetBackup components that load libraries insecurely. When a user executes specific NetBackup commands, the process can load a malicious DLL from an attacker-controlled location. Attackers typically leverage social engineering to convince the user to run the affected commands. Successful exploitation runs arbitrary code in the user's security context. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.
Critical Impact
Local code execution in the security context of the user running NetBackup commands on Windows, leading to potential compromise of backup infrastructure.
Affected Products
- Veritas NetBackup versions prior to 10.5
- NetBackup components running on Windows Operating System
- Windows hosts with NetBackup client or server binaries installed
Discovery Timeline
- 2024-11-18 - CVE-2024-52945 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-52945
Vulnerability Analysis
The vulnerability affects NetBackup command-line utilities on Windows that resolve dynamic-link library (DLL) dependencies using insecure search order. When a targeted NetBackup command runs, the process searches directories that a low-privileged user or attacker can influence before checking trusted system locations. A malicious DLL placed in one of these paths loads into the NetBackup process and executes attacker-controlled code.
Exploitation is local and requires user interaction. The attacker must either place the DLL in a writable directory accessible to the victim or trick the victim into running a NetBackup command from a directory containing the malicious library. The resulting code runs with the privileges of the user invoking the command, which in enterprise environments is often a backup administrator with elevated rights.
Root Cause
The root cause is improper control over library loading in NetBackup Windows components. Affected binaries do not enforce absolute paths or a restricted LOAD_LIBRARY_SEARCH_SYSTEM32 search policy when resolving DLL dependencies. Windows falls back to the standard DLL search order, which includes the current working directory and other locations attackers can populate.
Attack Vector
The attack requires local access and user interaction. A typical scenario involves an attacker delivering a crafted archive or shared folder containing a malicious DLL and a lure that instructs the user to execute a NetBackup command from that location. When the command runs, Windows loads the attacker's DLL instead of the legitimate one. The attacker's code then executes in the user's session and inherits the user's privileges, enabling lateral movement into the backup infrastructure. See the Veritas Security Advisory VTS24-012 for the vendor's technical description.
Detection Methods for CVE-2024-52945
Indicators of Compromise
- Unexpected DLL files appearing in directories adjacent to NetBackup command-line utilities or in user-writable working directories
- NetBackup processes (for example, bpplclients.exe, bpcd.exe, nbcertcmd.exe) loading DLLs from non-standard paths outside Program Files\Veritas\NetBackup
- Child processes spawned by NetBackup binaries that do not match expected backup operations, such as cmd.exe, powershell.exe, or scripting hosts
Detection Strategies
- Monitor image load events (Windows Sysmon Event ID 7) for NetBackup executables loading DLLs from unusual locations
- Alert on NetBackup binaries executed from user profile directories, temporary folders, or removable media
- Correlate process creation events showing NetBackup utilities invoking non-backup child processes
Monitoring Recommendations
- Enable command-line auditing (Event ID 4688 with command line) and Sysmon Event IDs 1, 7, and 11 on all NetBackup Windows hosts
- Baseline the set of DLLs legitimately loaded by NetBackup components and alert on deviations
- Forward endpoint telemetry to a centralized data lake for retrospective hunting against DLL side-loading patterns
How to Mitigate CVE-2024-52945
Immediate Actions Required
- Upgrade Veritas NetBackup to version 10.5 or later on all Windows systems running NetBackup components
- Inventory Windows hosts with NetBackup installed and prioritize systems used by backup administrators
- Restrict which users can execute NetBackup command-line utilities interactively
Patch Information
Veritas addressed the issue in NetBackup 10.5. Apply the fixed release on all affected Windows components. Refer to the Veritas Security Advisory VTS24-012 for the authoritative list of fixed versions and upgrade guidance.
Workarounds
- Instruct administrators to run NetBackup commands only from trusted directories such as the NetBackup installation path, never from user-writable or shared locations
- Apply Windows AppLocker or Windows Defender Application Control policies to block DLL loading from non-standard directories
- Remove write permissions from directories in the NetBackup DLL search path for non-administrative users
- Train backup operators to recognize social engineering attempts that instruct them to execute commands from unfamiliar folders
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
