CVE-2024-38650 & CVE-2024-39714 (CVSS 9.9): Critical Flaws in Veeam Console Put Data at Risk

by do son · September 5, 2024

A series of critical vulnerabilities have been discovered in Veeam Service Provider Console, a widely-used platform for managing data protection services in cloud and virtual environments. These vulnerabilities, some scoring as high as 9.9 on the CVSS severity scale, could allow attackers to gain unauthorized access, execute malicious code, and potentially compromise sensitive data.

Key Vulnerabilities and Their Impact

CVE-2024-38650 (CVSS 9.9): A vulnerability enabling low-privileged attackers to access the NTLM hash of the service account on the Veeam Service Provider Console server, paving the way for potential lateral movement and further system compromise.
CVE-2024-39714 (CVSS 9.9): This flaw permits low-privileged users to upload arbitrary files to the server, ultimately leading to remote code execution and granting attackers full control.
CVE-2024-39715 (CVSS 8.5): Similar to the previous vulnerability, this one allows low-privileged users with REST API access to remotely upload arbitrary files, again leading to remote code execution.
CVE-2024-38651 (CVSS 8.5): This vulnerability enables low-privileged users to overwrite files on the Veeam Service Provider Console server, which can also facilitate remote code execution.

Impact on Backup-as-a-Service and Disaster Recovery Operations

For service providers relying on VSPC to deliver BaaS and DRaaS, these vulnerabilities pose a severe threat. The ability to execute remote code or steal NTLM hashes could compromise backup integrity, expose sensitive customer data, and disrupt disaster recovery processes. Attackers gaining access to the VSPC server could manipulate backups, disable recovery processes, or even deploy ransomware.

The Urgency of Action

The severity of these vulnerabilities, coupled with the potential for widespread exploitation, makes immediate action crucial. Organizations utilizing Veeam Service Provider Console are strongly advised to update to version 8.1 (build 8.1.0.21377) or later without delay.