CVE-2015-5742 in Backup
Summary
by MITRE
VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by reading the files.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/22/2022
The vulnerability identified as CVE-2015-5742 affects Veeam Backup & Replication software versions prior to 8.0 update 3, specifically within the VeeamVixProxy component. This issue represents a critical configuration flaw that exposes sensitive authentication credentials in log files with overly permissive access controls. The vulnerability stems from improper handling of administrative credentials during backup operations, creating a persistent security risk that can be exploited by local attackers with minimal privileges.
The technical flaw manifests when VeeamVixProxy components generate log files containing local administrator credentials, which are then stored with world-readable permissions. This configuration violates fundamental security principles and creates an attack surface that allows any local user on the system to access these sensitive credentials through simple file read operations. The vulnerability is classified under CWE-200, which addresses "Information Exposure," and specifically relates to CWE-732, "Incorrect Permission Assignment for Critical Resource." The flaw occurs because the software fails to implement proper access control mechanisms for sensitive log file content, allowing unauthorized users to bypass normal authentication procedures.
The operational impact of this vulnerability extends beyond simple credential exposure, as local users who can read these log files gain access to administrative credentials that can be leveraged for privilege escalation and lateral movement within the network. Attackers can use these credentials to access backup repositories, modify backup configurations, or even escalate to domain-level administrative privileges depending on the environment structure. The vulnerability affects organizations using Veeam B&R software for backup and disaster recovery operations, potentially compromising the integrity and confidentiality of backup data. According to ATT&CK framework, this vulnerability maps to T1078 "Valid Accounts" and T1566 "Phishing," as it enables attackers to establish persistent access through legitimate administrative credentials obtained through information disclosure.
Organizations should immediately apply Veeam's 8.0 update 3 patch or later versions to address this vulnerability. System administrators should also conduct comprehensive log file audits to identify any previously compromised credentials and implement proper access controls for all backup-related log files. Additional mitigations include configuring log file permissions to restrict access to authorized personnel only, implementing file integrity monitoring solutions, and conducting regular security assessments of backup infrastructure. The vulnerability demonstrates the importance of secure credential handling in backup systems and highlights the need for organizations to maintain current security patches for critical infrastructure components. Proper configuration management and regular security reviews are essential to prevent similar issues in backup and recovery environments.