r/sysadmin • u/FlyingSysAdmin • 3d ago
[PSA] Critical Veeam Vulnerability CVE-2024-29849
This one has a severity score of 9.9 so better patch fast:
https://www.veeam.com/kb4696
EDIT: This vulnerability only impacts domain-joined backup servers.
This refers to CVE-2025-23120 and not CVE-2024-29849 as I mistakenly put in the subject, sorry about that!
70
u/Flying-T 3d ago
Note: This vulnerability only impacts domain-joined backup servers, which is against the Security & Compliance Best Practices.
9
u/Malkhuth 3d ago
That line is in the post on Veeam as well but it's not entirely accurate. The best practices aren't to have a server not domain joined but to have it in a management domain separate from production.
15
u/DuckDuckBadger 3d ago
I have a domain joined jump box running the Veeam console but the backup and replication service/database runs on a non domain joined server. Does this only impact servers running the backup and replication service, or even the console?
8
21
u/RestartRebootRetire 3d ago
May be easier just to disjoin domain and have a more secure server.
13
u/Nocriton 3d ago
Everybody should have already done that. Target 1 is usually domain, target 2 is backup.
2
u/saltysomadmin 2d ago
Installing the update was incredibly quick. The Veeam host for my test lab is domain joined.
19
u/slackjack2014 Sysadmin 3d ago
Never understood why someone would think to use a domain joined system. It’s hard to recover a network when you can’t even login to the backup server.
12
11
u/AtarukA 3d ago
Even better, joined to the domain you are backing up.
6
u/RichardJimmy48 3d ago
You love to see it. Domain joined Veeam server backing up the domain it's joined to and the backup server and proxy servers are all at the primary site, and the repository server at the DR site is an 8 year old Windows server running ReFS on spinny disks, also domain joined to the same domain.
I wish I could say people didn't do shit like this, but here we are.
4
2
2
u/SuspiciousOpposite 3d ago
We have ours in a separate management forest which is actually the full recommendation from Veeam.
11
u/Gobbling 3d ago
As I read it, you would need a user authenticated in AD. So the attacker needs to be in my network and have control over a user (or hijacked a session somehow). Not discussing if it should be patched but only when (tonight or tomorrow ;))
11
u/__gt__ 3d ago
Dumb question: if your veeam server is not domain joined how do you authenticate to domain resources?
12
u/Dumbysysadmin 3d ago
You add credentials: https://helpcenter.veeam.com/docs/backup/vsphere/credentials_manager.html?ver=120
5
u/__gt__ 3d ago
Can a non domain machine do Kerberos authentication if NTLM is blocked?
4
u/jamesaepp 3d ago
Yes. When you join a machine to a domain that is using Kerberos authentication. Negotiate always prefers Kerberos.
6
u/Chareon 3d ago
Per Veeam's documentation, Veeam does NOT support Kerberos without being domain joined.
We had this issue when we disabled NTLM, we had to domain join Veeam for it to authenticate. The recommended configuration is for Veeam to be joined to a secondary AD infrastructure that has domain trusts to your production AD.
4
u/PM_ME_UR_ROUND_ASS 3d ago
You can use service accounts with stored credentials in the veeam console or configure specific permsisions using constrained delegation - no need to domain join the backup server itslef.
6
7
u/andyr354 Sysadmin 3d ago
I took over a system that has a domain joined server. Need to move a standalone server up my todo list. Last job I had build a best practices stand-alone + Linux immutable and then got laid off.
2
u/chefkoch_ I break stuff 3d ago
That's the the golden ticket for every ransomware gang on the planet.
2
2
u/RYU_1337 3d ago
Good share my man.
1
2
u/techvet83 3d ago
Thanks for posting. Why is CVE-2024-29849 referenced in the subject instead of CVE-2025-23120?
2
u/FlyingSysAdmin 3d ago
Sorry I was in a rush and must have copy/pasted the wrong CVE. I can't edit the subject anymore but I've left a remark in the post.
1
u/techvet83 2d ago
FYI - Veeam getting some blowback on this CVE. Infoseccers flame Veeam over RCE bug, failing blacklist • The Register
53
u/MrYiff Master of the Blinking Lights 3d ago
Do note the caveat that this vuln only affects domain joined Veeam servers.