1name: crowdsecurity/vpatch-CVE-2024-29849
2description: "Veeam Backup Enterprise Manager - Authentication Bypass (CVE-2024-29849)"
3rules:
4  - and:
5    - zones:
6      - URI
7      match:
8        type: endsWith
9        value: /api/sessionMngr/
10    - zones:
11      - METHOD
12      match:
13        type: equals
14        value: POST
15    - zones:
16      - ARGS
17      variables:
18        - v
19      match:
20        type: equals
21        value: "latest"
22    - zones:
23      - BODY_ARGS
24      transform:
25        - b64decode
26      variables:
27        - json.VMwareSSOToken
28      match:
29        type: contains
30        value: "<saml2:Assertion"
31    - zones:
32        - BODY_ARGS
33      variables:
34        - json.VMwareSSOToken
35      transform:
36        - b64decode
37      match:
38        type: contains
39        value: "<saml2:Issuer"
40    - zones:
41        - BODY_ARGS
42      variables:
43        - json.VMwareSSOToken
44      transform:
45        - b64decode
46      match:
47        type: contains
48        value: "/STSService"
49
50labels:
51  type: exploit
52  service: http
53  confidence: 3
54  spoofable: 0
55  behavior: "http:exploit"
56  label: "Veeam Backup Enterprise Manager - Authentication Bypass"
57  classification:
58    - cve.CVE-2024-29849
59    - attack.T1595
60    - attack.T1190
61