A GUID Is Not a Credential Unauthenticated RCE in Veeam Serv...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console
• Blog Title: A GUID Is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Veeam Service Provider Console; cross-reference File Inclusion/Path Traversal and Windows Arbitrary File Write

🎯 Content Summary

Overview

Bishop Fox reverse-engineered and reproduced an unauthenticated remote-code-execution chain in Veeam Service Provider Console (VSPC), a Windows-based, multi-tenant backup-management control plane used by service providers and large enterprises. The chain combines CVE-2026-58073 (CVSS v4.0 9.5), which lets an unauthenticated peer impersonate a connected management agent and obtain a genuine agent certificate, with CVE-2026-58072🔧 Technical Details

Global-session identity confusion: An identifier is not proof that the current connection owns the corresponding authenticated session. If authorization looks up an attacker-controlled user, device, tenant, or agent ID in process-global login state without binding the result to the current certificate, token, socket, or cryptographic proof, an attacker may reuse the identifier of an active principal. In this case, supplying a connected agent's GUID in a self-signed certificate caused the server to find the legitimate agent's login record and install no authorization interceptor, exposing unrestricted RPC invocation.

Permissive enrollment combined with post-handshake authorization: Systems that accept self-signed certificates for first-time enrollment must keep those peers strictly confined to enrollment operations. If failed chain validation still produces a successful guest connection, test whether later authorization independently trusts cer...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Created src/network-services-pentesting/pentesting-web/veeam-service-provider-console.md
• Added navigation links in:
  • src/network-services-pentesting/pentesting-web/README.md
  • src/SUMMARY.md

The page covers agent-session identity confusion, durable certificate issuance, rooted .NET Path.Combine file writes, safe patch fingerprinting, exploitation-chain logging, and remediation.

Validation

• Internal links resolve.
• References and citations are correctly numbered.
• External references return HTTP 200.
• git diff --check passes.
• No forbidden sources are present.
• mdbook was unavailable, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Veeam Service Provider Console; cross-reference File Inclusion/Path Traversal and Windows Arbitrary File Write".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0