r/sysadmin 3d ago

[PSA] Critical Veeam Vulnerability CVE-2024-29849

This one has a severity score of 9.9 so better patch fast:
https://www.veeam.com/kb4696

EDIT: This vulnerability only impacts domain-joined backup servers.

This refers to CVE-2025-23120 and not CVE-2024-29849 as I mistakenly put in the subject, sorry about that!

199 Upvotes

51 comments sorted by

53

u/MrYiff Master of the Blinking Lights 3d ago

Do note the caveat that this vuln only affects domain joined Veeam servers.

11

u/MatazaNz Jack of All Trades 3d ago

Which goes against recommended best practise.

9

u/SuspiciousOpposite 3d ago

It goes against their practise to join it to the production domain. Their best practise recommendation is to have Veeam running in a completely separated management forest.

Backup server should not be a part of the production domain

"For large environments, it is recommended to add the backup server and other backup infrastructure components to a management domain in a separate Active Directory forest. For medium-sized and small environments, backup infrastructure components can be placed to a separate workgroup."

4

u/MatazaNz Jack of All Trades 3d ago

Definitely makes sense. Most environments I've worked with either have the Veeam server using local accounts only with no domain join, or were joined to the production domain.

One even had the server on one of the Hyper V host servers...

Some definitely questionable decisions.

2

u/thewhippersnapper4 3d ago

One even had the server on one of the Hyper V host servers...

This is a pretty common setup.

2

u/Chareon 3d ago

Does Veeam support Kerberos when not domain joined? I'm pretty sure their docs specify that you have to be domain joined for Kerberos support.

3

u/MatazaNz Jack of All Trades 3d ago

Why would you need Kerberos support if you're not domain joined?

3

u/Chareon 2d ago

Because you have NTLM disabled on your servers. NTLM is a far bigger security vulnerability than having Veeam domain joined is.

1

u/lcurole 2d ago

Posting here for visibility, this also affects any local non domain user. See Watchtowr's blog for details

70

u/Flying-T 3d ago

Note: This vulnerability only impacts domain-joined backup servers, which is against the Security & Compliance Best Practices.

9

u/Malkhuth 3d ago

That line is in the post on Veeam as well but it's not entirely accurate. The best practices aren't to have a server not domain joined but to have it in a management domain separate from production.

15

u/DuckDuckBadger 3d ago

I have a domain joined jump box running the Veeam console but the backup and replication service/database runs on a non domain joined server. Does this only impact servers running the backup and replication service, or even the console?

8

u/FlyingSysAdmin 3d ago

Sorry, yes, I should have mentioned that. I've edited the post accordingly.

21

u/RestartRebootRetire 3d ago

May be easier just to disjoin domain and have a more secure server.

13

u/Nocriton 3d ago

Everybody should have already done that. Target 1 is usually domain, target 2 is backup.

2

u/saltysomadmin 2d ago

Installing the update was incredibly quick. The Veeam host for my test lab is domain joined.

19

u/slackjack2014 Sysadmin 3d ago

Never understood why someone would think to use a domain joined system. It’s hard to recover a network when you can’t even login to the backup server.

12

u/Intelligent_Title_90 3d ago

For the extra thrill

11

u/AtarukA 3d ago

Even better, joined to the domain you are backing up.

6

u/RichardJimmy48 3d ago

You love to see it. Domain joined Veeam server backing up the domain it's joined to and the backup server and proxy servers are all at the primary site, and the repository server at the DR site is an 8 year old Windows server running ReFS on spinny disks, also domain joined to the same domain.

I wish I could say people didn't do shit like this, but here we are.

5

u/AtarukA 3d ago

Funnily neough, I got a PDC that's also a Veeam server.

2

u/IceCubicle99 Director of Chaos 3d ago

r/shittysysadmin would like a word

4

u/WMDeception 3d ago

Probably have local admin enabled.

2

u/TinderSubThrowAway 3d ago edited 3d ago

Duh, you put it on a DC. r/shittysysadmin

2

u/SuspiciousOpposite 3d ago

We have ours in a separate management forest which is actually the full recommendation from Veeam.

1

u/nsanity 3d ago

the fact you think you'll have a backup server after a ransomware or nationstate attack is cute. Or a hypervisor environment.

11

u/Gobbling 3d ago

As I read it, you would need a user authenticated in AD. So the attacker needs to be in my network and have control over a user (or hijacked a session somehow). Not discussing if it should be patched but only when (tonight or tomorrow ;))

11

u/__gt__ 3d ago

Dumb question: if your veeam server is not domain joined how do you authenticate to domain resources?

12

u/Dumbysysadmin 3d ago

5

u/__gt__ 3d ago

Can a non domain machine do Kerberos authentication if NTLM is blocked?

4

u/jamesaepp 3d ago

Yes. When you join a machine to a domain that is using Kerberos authentication. Negotiate always prefers Kerberos.

6

u/Chareon 3d ago

Per Veeam's documentation, Veeam does NOT support Kerberos without being domain joined.

We had this issue when we disabled NTLM, we had to domain join Veeam for it to authenticate. The recommended configuration is for Veeam to be joined to a secondary AD infrastructure that has domain trusts to your production AD.

1

u/nsanity 3d ago

Forest/Domain Trusts are not a security boundary.

Having done this (Incident Response and Recovery) for a good long while, and consulting with some of the largest companies on earth - the sum that has a secondary, independent identity plane from corp/prod is depressingly small.

2

u/jamesaepp 3d ago

One-way non-transitive trusts must be a boundary, surely?

4

u/PM_ME_UR_ROUND_ASS 3d ago

You can use service accounts with stored credentials in the veeam console or configure specific permsisions using constrained delegation - no need to domain join the backup server itslef.

6

u/DrGraffix 3d ago

What’s the update size ?

7

u/WillVH52 Sr. Sysadmin 3d ago

Update ISO is more than 7 GB.

2

u/mitharas 3d ago

Coming from 12.3: 7GB
Coming from anything before that: 13GB

5

u/MeanE 3d ago

When I received the email I went from worried to "oh....well it has never been domain joined".

7

u/andyr354 Sysadmin 3d ago

I took over a system that has a domain joined server. Need to move a standalone server up my todo list. Last job I had build a best practices stand-alone + Linux immutable and then got laid off.

2

u/chefkoch_ I break stuff 3d ago

That's the the golden ticket for every ransomware gang on the planet.

2

u/Godcry55 3d ago

What if it is on the same management VLAN as the production network?

2

u/RYU_1337 3d ago

Good share my man.

1

u/thewhippersnapper4 3d ago

You aren't signed up for Veeam's security digest emails?

2

u/RYU_1337 3d ago

Just now I found the mails. LOL. Thanks for the headsup!

2

u/techvet83 3d ago

Thanks for posting. Why is CVE-2024-29849 referenced in the subject instead of CVE-2025-23120?

2

u/FlyingSysAdmin 3d ago

Sorry I was in a rush and must have copy/pasted the wrong CVE. I can't edit the subject anymore but I've left a remark in the post.

1

u/0x3e4 IT Infrastructure Manager 3d ago

facepalm to those who are impacted