Challenge
The vulnerability allows any local Windows user with low privileges, such as the ones provided to an anonymous IIS's virtualhost user, to access Veeam Backup logfiles and extract the password, used to run Veeam components, which is stored as a doublebase64 encoded string.Cause
The affected component is VeeamVixProxy, created by default on installation and configured to run with a privileged Local Administrator or a Domain Administrator account.Using such accounts is correct and required for the components to run properly, as stated by the userguide and wizard prompts for adding a VMware or HyperV Backup Proxies:
"Type in an account with local administrator privileges
on the server you are adding. Use DOMAIN\USER format for domain
accounts, or HOST\USER for local accounts."
We conservatively refer to this issue as a Local Administrator Privilege Escalation but the use of Domain Administrator accounts for Veeam is not discouraged, if not advised, and this is a common pattern in production.
Solution
Update Veeam Backup & Replication to version 8.0 Update 3 or 9.x.Workaround:
If Veeam B&R is installed on a Windows 2003 environment, change the access permissions on %alluserprofile%\Application Data\Veeam\Backup and subdirectories, so that only members of the "Administrators" group can read it.
If Veeam B&R is installed on Windows 2008 and newer, change the access permissions on %programdata%\Veeam\Backup\ and subdirectories, so that only members of the "Administrators" group can read it.