Yashar Shahinzadeh

Cross-Site Scripting (XSS) occurs in the number guess example application due to improper neutralization of script-related HTML tags in a web page. XSS is a flaw that allows an attacker to inject malicious scripts into content delivered to other users.

The issue concerns a flaw in access control within Veeam ONE Agent. Successful exploitation allows a remote attacker possessing the service account credentials for Veeam ONE Agent to execute code on the system where the agent is installed. The vulnerability allows for remote code execution.

The issue allows high-privileged users to read backup session logs. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Veeam Backup Enterprise Manager has a flaw that allows unauthenticated users to log in as any user to the enterprise manager web interface. The vulnerability resides in the `Veeam.Backup.Enterprise.RestAPIService.exe` service, which listens on TCP port 9398 and functions as a REST API server. Exploitation involves sending a specially crafted VMware Single Sign-On (SSO) token via the API. The token includes an authentication request impersonating an administrator and a URL for the SSO service, which Veeam does not validate. The decoded token is interpreted as XML and verified through a SOAP request to a URL controlled by the attacker. A server controlled by the attacker responds positively to verification requests, allowing the attacker to gain administrative access. The vulnerability allows an attacker to bypass authentication and access the Backup Enterprise Manager. A proof-of-concept (PoC) exploit is publicly available. The vulnerability is tracked as CVE-2024-29849 and has a CVSS score of 9.8.

The issue allows account takeover via NTLM relay. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue is related to weaknesses in the authentication procedure of Veeam Agent for Microsoft Windows, allowing for local privilege escalation. This can enable an attacker to elevate their privileges.

Name of the Vulnerable Software and Affected Versions: Veeam Backup Enterprise Manager (affected versions not specified) Description: The issue allows high-privileged users to steal the NTLM hash of the Enterprise manager service account. This is related to insufficient access control in Veeam Backup & Replication, which can be exploited by a remote attacker to gain unauthorized access to the NTLM hash. The exploitation is possible if the service account is not the default Local System account. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `element 2` parameter in the view.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `element 2` parameter in the view.php file.

The issue allows remote attackers to execute arbitrary PHP code by uploading a PHP file to the upload form's directory in data/, then accessing it via a direct request. This is due to an unrestricted file upload vulnerability in view.php.