# Veeam Backup & Replication CVE-2023-27532 Response

Unauthenticated API on Veeam Backup & Replication port 9401 leaks encrypted host credentials and decrypts them to plaintext, enabling lateral movement and RCE.

- Payout: Research
- Severity: high
- Program: Veeam Backup
- Credited: Huntress
- Disclosed: 2023-03-13
- CVE: CVE-2023-27532
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/veeam-backup-replication-cve-2023-27532-response
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response
- Tags: domain:infra impact:data-leak impact:privesc impact:rce kind:research platform:threat-intel sev:high tech:windows technique:source-review vuln:auth-bypass vuln:info-disclosure vuln:rce

**Target:** Veeam.Backup.Service.exe local API on TCP port 9401
**Root cause:** The Veeam Backup Service API on port 9401 lacks authentication, allowing any client to query stored credentials and invoke a separate decrypt call that returns plaintext.
**Steps:**
1. Connect to the Veeam Backup Service API on `0.0.0.0:9401` with no authentication token.
2. Query the API for stored credentials; receive encrypted values plus account UUIDs.
3. Issue a second API call per account UUID to decrypt credentials into Base64 plaintext.
4. Use recovered usernames/passwords to access managed hosts and move laterally.
5. (Extended PoC) Invoke other unauthenticated API methods to achieve arbitrary code execution on the Veeam server.
**How found:** Huntress saw Code White's tweet that Markus Wulftange built an exploit using only the exposed API, then recreated the PoC against Veeam 11.0.1.1261 and confirmed credential extraction, later probing other API methods for RCE.
**Exploitation:** Attacker with network access to TCP 9401 interrogates the unauthenticated API, dumps encrypted credentials, decrypts them via a second API call, then reuses plaintext credentials to log into managed hosts and pivot; no child processes or filesystem artifacts are created and default logging omits API calls.
**Escalation:** Credential dump enables lateral movement; further unauthenticated API calls were chained to achieve remote code execution on the Veeam server itself.
**Insight:** When a vendor patches by adding JWT auth to an API, enumerate every method the pre-patch service exposed unauthenticated—credential-read plus a separate decrypt endpoint turned a read into plaintext secrets, and sibling methods yielded RCE.