Veeam has issued patches for a critical security vulnerability in its Backup & Replication software that could allow attackers to achieve remote code execution on servers joined to Active Directory domains.
The flaw, tracked as CVE-2024-20304, carries a CVSS score of 8.8 and stems from an unsafe deserialization weakness. Veeam disclosed the issue in an official security advisory and addressed it in Backup & Replication version 12.1.2.172. Detailed technical reporting was subsequently provided by BleepingComputer.
Backup Infrastructure: A High-Value Target
The severity of the vulnerability is amplified by the nature of the systems it affects. Backup servers are among the most attractive targets for threat actors, particularly ransomware operators, because compromising them can simultaneously encrypt or destroy an organisation's ability to recover data. A successful exploit of CVE-2024-20304 on a domain-joined backup server could give attackers not only control over the backup infrastructure itself, but also a foothold for lateral movement across the Active Directory environment.
Domain-joined configurations — common in enterprise deployments where backup systems need to authenticate against directory services — dramatically expand the blast radius of any compromise. An attacker who gains RCE on such a system inherits the permissions and network access associated with that machine, potentially enabling privilege escalation and movement to other critical systems.
A Recurring Attack Surface
This is not the first time Veeam's backup platform has drawn serious attention from the security community. In 2023, CVE-2023-27532 was actively exploited in the wild, allowing attackers to extract credentials from Veeam Backup & Replication configurations. That vulnerability was leveraged by threat groups associated with ransomware campaigns, reinforcing the pattern that backup software represents a persistent and lucrative target.
The emergence of CVE-2024-20304 underscores that Veeam's products remain under sustained scrutiny from both defenders and attackers. For IT administrators, this latest disclosure serves as a reminder that backup infrastructure cannot be treated as a set-and-forget component of the data protection strategy.
What Administrators Should Do
Organisations running Veeam Backup & Replication should upgrade to version 12.1.2.172 or later immediately. Beyond patching, security teams should consider the following measures:
- Audit domain-join configurations of backup servers and evaluate whether standalone or workgroup membership is feasible.
- Restrict network access to backup infrastructure using segmentation and firewall rules, limiting exposure to only necessary management interfaces.
- Monitor for indicators of compromise related to deserialization exploits targeting backup platforms.
- Review backup integrity regularly to ensure that recovery data has not been tampered with.
Broader Implications
The disclosure highlights a growing trend in enterprise security: attackers are increasingly targeting the tools organisations depend on for resilience rather than just their primary production systems. Backup and recovery platforms, endpoint management consoles, and monitoring tools all represent high-value, often under-secured assets that can serve as force multipliers during an intrusion.
For IT professionals managing backup environments — regardless of platform — CVE-2024-20304 is a prompt to reassess the security posture of infrastructure that quietly underpins an organisation's ability to withstand and recover from cyberattacks.
Veeam 已為其 Backup & Replication 軟件中的一個嚴重安全漏洞發佈了修補程式，該漏洞可能允許攻擊者在已加入 Active Directory 域的伺服器上執行遠端程式碼。
此漏洞的編號為 CVE-2024-20304，CVSS 評分為 8.8，源自一個不安全的反序列化弱點。Veeam 在一份官方安全公告中披露了此問題，並已在 Backup & Replication 12.1.2.172 版本中修復。隨後，BleepingComputer 提供了詳細的技術報告。
備份基礎設施：高價值目標
此漏洞的嚴重性因其影響系統的性質而加劇。備份伺服器是威脅行為者（特別是勒索軟件攻擊者）最具吸引力的目標之一，因為入侵它們可以同時加密或摧毀組織恢復數據的能力。在已加入域的備份伺服器上成功利用 CVE-2024-20304，不僅可能讓攻擊者控制備份基礎設施本身，還能為他們提供在 Active Directory 環境中橫向移動的立足點。
在企業部署中，為了向目錄服務進行身份驗證，備份系統採用加入域的配置很常見，但這極大地擴大了任何入侵事件的爆炸半徑。攻擊者若能在這類系統上獲得遠端程式碼執行權限，將繼承該機器關聯的權限和網絡訪問權限，可能導致權限提升並轉移至其他關鍵系統。
一個反覆出現的攻擊面
這並非 Veeam 的備份平台首次引起安全社群的高度關注。2023 年，CVE-2023-27532 就曾被積極在野外利用，允許攻擊者從 Veeam Backup & Replication 配置中提取憑據。該漏洞曾被與勒索軟件攻擊相關的威脅組織利用，這強化了備份軟件代表著一個持續且有利可圖的目標這一模式。
CVE-2024-20304 的出現表明，Veeam 的產品仍然處於防禦者和攻擊者雙方的持續監控之下。對於 IT 管理員而言，這次最新的披露是一個提醒：備份基礎設施不能被當作數據保護策略中一個「設定好就忘記」的組件。
管理員應採取的行動
運行 Veeam Backup & Replication 的組織應立即升級至 12.1.2.172 或更高版本。除了打補丁之外，安全團隊還應考慮以下措施：
- 審計備份伺服器的域加入配置，評估是否可採用獨立或工作組成員身份。
- 使用分段和防火牆規則限制對備份基礎設施的網絡訪問，將暴露面限制在僅必要的管理接口。
- 監控與針對備份平台的反序列化漏洞利用相關的入侵指標。
- 定期檢查備份完整性，確保恢復數據未被篡改。
更廣泛的影響
此次披露凸顯了企業安全領域一個日益增長的趨勢：攻擊者正越來越多地針對組織賴以保持彈性的工具，而不僅僅是其主要的生產系統。備份與恢復平台、端點管理控制台和監控工具都代表著高價值、但常常安全防護不足的資產，它們在入侵過程中可以成為力量倍增器。
對於管理備份環境的 IT 專業人士而言（無論使用何種平台），CVE-2024-20304 都是一個促使他們重新評估那些默默支撐組織抵禦和從網絡攻擊中恢復能力的基礎設施安全態勢的契機。