Veeam Backup for Google Cloud Critical Vulnerability (CVE-2022-43549)

Veeam Software AG had published a security advisory concerning a vulnerability in Veeam Backup for Google Cloud.

Automatic Patching of components
The fix for the vulnerability discussed in this article has been automatically deployed to all Veeam Backup for Google Cloud Backup Appliances that have been configured to have access to repository.veeam.com. Most users will have no additional actions to perform beyond confirming the Veeam Updater component version.

For deployments where the Veeam Backup for Google Cloud Backup Appliance does not have network access to the Veeam Update Repository, the fix must be deployed manually.

Vulnerability details
During internal testing, a vulnerability was discovered within the backup appliance component of Veeam Backup for Google Cloud that allows users to bypass authentication mechanisms.

Severity: Critical
CVSS v3 Score: 10.0
Status: Resolved

Solution
A fix has been released to resolve the discovered vulnerability in Veeam Backup for Google Cloud versions 1 and 3. For most users, no actions will be needed, as the Veeam Updater component will have automatically installed this fix during its daily check for updates ⁽¹⁾. After the fix has been installed, the Backup Appliance will be restarted automatically. For environments where the Veeam Backup for Google Cloud backup appliance does not have access to repository.veeam.com, the fix will have to be manually deployed ⁽²⁾ or internet access configured to allow access to the update server.

Verify update deployment
The fix for the vulnerability documented in this article is being shipped alongside Veeam Updater version 6.0.0.814 and higher.
The Veeam Updater component version is displayed in the top-right of the web interface. ⁽³⁾

^{Shown above is the location of Veeam Updater component version}

More information
⁽¹⁾ The Veeam Updater checks for updates every 24 hours. The Veeam Updater will automatically install updates to the Veeam Updater component and critical updates for other components.
⁽²⁾ The update check requires that the Veeam Backup for Google Cloud backup appliance have internet access and be able to reach repository.veeam.com as documented in the product user guide. If the Veeam Backup for Google Cloud backup appliance does not have internet access, a manual update process is available. Contact Veeam Support for assistance. After manual updating, the Updater UI will have to be reopened to see the updated version listed.
⁽³⁾ If the Veeam Updater UI is opened before it has updated automatically, clicking “Check for Updates…” will cause the Veeam Updater UI to download the update and become inaccessible while the Backup Appliance is automatically restarted to apply the fix. After reopening the Veeam Updater, the new version number will be displayed.