CVE-2023-27532
HIGH KEV RANSOMWAREVeeam Backup & Replication < 11.0.1.1261 - Unauthenticated Credential Disclosure
Title source: llmExploitation Summary
CVE-2023-27532 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 22, 2023, with confirmed use in ransomware campaigns. EIP tracks 4 public exploits from researchers including sfewer-r7, horizon3ai, yunus-a1i.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-27532, targeting Veeam Backup & Replication. The exploit leverages a deserialization vulnerability to either leak plaintext credentials or execute remote commands via SQL injection.
Description
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
Exploits (4)
This repository contains a functional exploit for CVE-2023-27532, targeting Veeam Backup & Replication. The exploit leverages a deserialization vulnerability to either leak plaintext credentials or execute remote commands via SQL injection.
This repository contains a functional exploit for CVE-2023-27532, targeting Veeam Backup & Replication. The exploit leverages insecure deserialization to extract credentials from the Veeam server by interacting with the RemoteInvokeService.
This repository provides a mock server and a Nuclei template for detecting CVE-2023-27532, a vulnerability in Veeam Backup & Replication that allows extraction of encrypted credentials. The mock server simulates vulnerable endpoints, while the Nuclei template includes HTTP and network-based detection methods.
This repository contains a functional exploit for CVE-2023-27532, targeting Veeam Backup & Replication. The exploit leverages a WCF endpoint to execute arbitrary SQL commands, enabling remote code execution via `xp_cmdshell`.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N