Veeam Backup & Replication Authentication Bypass and Credential Exposure (CVE-2023-27532) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-27532) is a critical missing authentication vulnerability (CWE-306) within the internal communication process of Veeam Backup & Replication. The Veeam Backup Service, which listens on TCP port 9401 by default, fails to perform adequate user authentication and authorization checks when handling internal API requests. This architectural flaw allows unauthenticated remote attackers to directly query the service and retrieve encrypted database connection strings and credentials stored in the configuration database.

2. Exploitation Mechanics & Attack Scenario

An attacker begins by scanning the network for exposed TCP port 9401 on target systems. Once identified, the attacker transmits specially crafted API requests mimicking legitimate Veeam service traffic. Because the service does not validate the requester's identity, it responds with the requested configuration details, including encrypted credentials. Although the credentials are encrypted, they can be decrypted using static keys or known decryption routines within the Veeam environment, allowing the attacker to obtain plaintext administrative credentials for hypervisors, backup proxies, and domain controllers.

3. Infrastructure & Business Impact

This vulnerability is highly critical and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active exploitation by ransomware groups and APT actors in the wild. Compromising the backup infrastructure allows adversaries to delete or encrypt backup repositories, neutralizing the organization's disaster recovery capabilities. This leads to catastrophic business disruption, data loss, and severe financial and reputational damage.