Loading vulnerability…
CVE-2024-29849 is a critical authentication bypass vulnerability in Veeam Backup Enterprise Manager. The flaw affects the Enterprise Manager REST API authentication flow used by the web interface and allows an unauthenticated remote attacker to authenticate as an arbitrary user. Available technical analysis indicates the vulnerable code path is triggered when a VMware SSO token is supplied to the login workflow. The service base64-decodes and parses the attacker-supplied SAML assertion, extracts the Issuer value from the token, constructs a token-validation endpoint from that untrusted value, and then submits the assertion for validation to that attacker-influenced endpoint. Because the application trusts the validation result returned by the remote endpoint, an attacker can cause the product to accept a forged token as valid. After validation, the application extracts the NameID from the same attacker-controlled assertion and resolves it to a Windows account identity, enabling login as any chosen user, including administrative accounts. The issue has been described as affecting Veeam Backup Enterprise Manager versions prior to 12.1.2.172.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a working exploit for CVE-2024-29849, an authentication bypass vulnerability in Veeam Backup Enterprise Manager (versions prior to 12.1.2.172). The exploit is implemented in a single Python script (CVE-2024-29849.py) and is accompanied by a detailed README.md with usage instructions and background information. The exploit works by running an attacker-controlled HTTPS callback server that serves a malicious SAML assertion. The script then sends a crafted authentication request to the target Veeam Backup Enterprise Manager's API, impersonating an arbitrary user (default: administrator). If successful, the exploit retrieves a valid session token, which is then used to access further API endpoints, such as enumerating file servers. Key endpoints involved include the target's /api/sessionMngr/?v=latest for authentication and /api/nas/fileServers?format=Entity for post-exploitation. The attacker must provide their own TLS certificate and key for the callback server (server.pem and key.pem). The exploit is operational and provides a real authentication bypass, not just a proof of concept or detection script. The repository is well-structured, with clear instructions and technical details, and is intended for use by security professionals for research and defensive purposes.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication bypass vulnerability in Veeam Backup Enterprise Manager where a POST to /api/token with an empty password can return an access token on vulnerable instances prior to version 12.1.2.172.
Critical authentication bypass vulnerability in Veeam Backup Enterprise Manager that allows an unauthenticated attacker to log in as any user by abusing forged VMware SSO tokens validated against an attacker-controlled server.
A critical authentication bypass in Veeam Backup Enterprise Manager that allows an unauthenticated attacker to log in as any user by supplying a crafted VMware SSO token and abusing attacker-controlled token validation.
A critical authentication bypass in Veeam Backup Enterprise Manager that can allow an unauthenticated attacker to log in as any user via the web interface.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.