• Creation
  • Validation
  • Communication & fix
  • Disclosure

Bitstop Inc / Veeam Backup & Replication Remote code execution in Bitstop Inc assets

iampritam reported 2022-04-11

Description

A vulnerability (CVE-2022-26500) exists in the Veeam Distribution Service. This component allows executing malicious code remotely without authentication. This may lead to gaining control over the target system.

The Veeam Distribution Service, using TCP 9380 with default settings, allows unauthenticated users to access internal API functions. A remote attacker may send input to the internal API which may lead to uploading and executing of malicious code.

Your server has been found vulnerable to Veeam RCE.

This means an attacker can currently access your backup servers, execute code, and download/modify/erase its content.

Reference

https://www.veeam.com/kb4288

IP:
202.91.163.46
Port:
9380
Detected protocol:
veeam-ds
Found Veeam distribution service, vulnerable to CVE-2022-26500, CVE-2022-26501
===================================================================
Log has been started by 'WIN-RT0GPBGQTTQ\SYSTEM' user (Non-interactive)
Logging level: [4 (AboveNormal)]
MachineName: [WIN-RT0GPBGQTTQ], OS: [Microsoft Windows Server 2019 Standard (10.0.17763)], CPU: [24]
Process: [64 bit], PID: [4556], SessionId: [0]
UTC Time: [3/23/2022 2:39:17 PM], DaylightSavingTime: [False]
Culture: [en-US], UI culture: [en-US]
Module: [C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Service.exe]. File version: [11.0.0.837], Assembly version: [11.0.0.0], Edition: [standard]
Process start time: [2/5/2022 2:07:12 AM], Garbage collector mode: [Server]
CmdLineParams: []
Network Interface, Name: vEthernet (Private - Eth), Description: Hyper-V Virtual Ethernet Adapter #2, Interface Type: Ethernet, Operational Status: Up;
Found by veeaml9 2022-04-11
Report created by iampritam  2022-04-11
Report approved by BloodyShell  2022-04-11
New PDF report generated by system 2022-04-11
Report dispatched to ...@... by system 2022-04-11
Report dispatched to ...@... by system 2022-04-11
Report marked as fixed by BloodyShell  2022-04-29
Report closed by BloodyShell  2022-04-29
New PDF report generated by system 2022-04-29
Information
Owner Bitstop Inc
Created 2022-04-11 12:15
Updated 2022-04-29 13:29
Fixed true

Contacts
n...@bitstop.co
d...@bitstop.co

Status
Status closed
Hosting contacted false
CERT contacted false

Download report