One Day Sec

How does CVE-2023-27532 allow credential leakage in Veeam Backup & Replication, and how can I parse the leaked data?

CVE-2023-27532 exploits the `CredentialsDbScopeGetAllCreds` function to retrieve stored credentials in plaintext via a POC. The returned data is Base64-encoded serialized XML. To parse it correctly, use Veeam’s built-in `Veeam.Backup.Core.CProxyBinaryFormatter.Deserialize` method to extract fields like `DomainName`, `UserName`, and `Password`. This analysis is detailed in the Setting Up Veeam Backup & Replication Vulnerability Debugging Environment article, with similarities to other debugging setups like Sophos XG Vulnerability Debugging Environment Setup.
CVE-2023-27532credential leakageVeeam Backup & Replicationserialized XMLdeserializationPOC

Browse all Q&A →