CVE-2024-22022 in Recovery Orchestrator
Summary
by MITRE • 02/07/2024
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/04/2025
CVE-2024-22022 represents a critical privilege escalation vulnerability within Veeam Recovery Orchestrator that enables low-privileged users to extract NTLM hashes from service accounts. This vulnerability falls under the category of credential exposure and privilege escalation as defined by CWE-255 and CWE-264. The flaw exists in the authentication and authorization mechanisms of the Veeam Recovery Orchestrator platform, specifically within the service account management system where insufficient access controls allow unauthorized users to retrieve sensitive authentication material.
The technical implementation of this vulnerability exploits a weakness in the role-based access control (RBAC) framework that governs user permissions within the Veeam environment. When a user with a low-privileged role attempts to access certain system components, the application fails to properly validate whether the requesting user has adequate authorization to retrieve service account credentials. This misconfiguration creates an information disclosure vulnerability that directly violates the principle of least privilege and allows for potential credential theft attacks. The NTLM hash extraction occurs through a direct query or API call that should be restricted to administrators or privileged system accounts but is accessible to users with minimal permissions.
The operational impact of CVE-2024-22022 extends beyond simple credential theft, as NTLM hashes can be used for lateral movement attacks within the network infrastructure. This vulnerability aligns with ATT&CK technique T1078.004 which covers valid accounts and T1566 which covers credential harvesting through social engineering or system exploitation. Once an attacker obtains the service account hash, they can potentially authenticate to other systems where that account has access, enabling them to escalate privileges and move laterally through the network. The compromised service account may have elevated permissions within the Veeam environment and potentially access to backup systems, databases, or other critical infrastructure components.
Organizations affected by this vulnerability should immediately implement mitigations including restricting access to sensitive system components, enforcing stricter RBAC policies, and monitoring for unauthorized access attempts to service account information. The vulnerability also highlights the importance of proper privilege management and the need for regular security assessments of authentication systems. Security teams should conduct immediate vulnerability scans to identify affected systems and implement network segmentation to limit the potential impact of credential compromise. Additionally, organizations should review their incident response procedures to ensure they can quickly detect and respond to unauthorized access attempts to service account information. The vulnerability demonstrates the critical importance of maintaining up-to-date security patches and implementing comprehensive monitoring solutions that can detect anomalous access patterns to privileged system components.
This vulnerability represents a significant risk to organizations that rely on Veeam Recovery Orchestrator for backup and disaster recovery operations, as the compromised service account could provide attackers with access to critical backup infrastructure and potentially sensitive data stored within backup repositories. The security implications extend to potential data exfiltration scenarios where attackers could leverage the compromised credentials to access backup files and restore malicious files to production systems. Organizations should also consider implementing additional authentication controls such as multi-factor authentication for service accounts and regular credential rotation to reduce the window of opportunity for attackers who might exploit this vulnerability.