Headline
CVE-2023-41723: CVE-2023-38547 | CVE-2023-38548 | CVE-2023-38549 | CVE-2023-41723
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view the schedule and cannot make changes.
#Display Installed Veeam ONE Version
Write-Host “Checking for installed Veeam ONE…”n $veeamOnePackage = Get-Package -ProviderName msi | Where-Object { $_.Name -eq "Veeam ONE Reporter Server" } if ($null -eq $veeamOnePackage) { Write-Host "Veeam ONE does not appear to be installed on this machine."
n -ForegroundColor Red
BREAK
} else {
$installedVersion = $veeamOnePackage.Version
Write-Host "The following Veeam ONE Build is installed: $installedVersion"`n -ForegroundColor Green
# If the installed version is 12.0.0.2498 and display an update message and terminate.
if ($installedVersion -eq "12.0.0.2498") {
Write-Host "ERROR: Installed Veeam ONE build is 12.0.0.2498, update to build 12.0.1.2591 is required. See KB4430"`n -ForegroundColor Red
BREAK
}
}
Define Veeam ONE Reporter Server Root Folder
$installLocation = $veeamOnePackage.Source
$rootFolder = Join-Path -Path $installLocation -ChildPath “Veeam ONE Reporter Server”
List of files to check
$fileList = @(
"Veeam.Reporter.GrpcService.dll",
"Veeam.Reporter.WebApiService.dll",
"Veeam.Reporter.PackInstaller.dll",
"Veeam.Reporter.GrpcShared.dll",
"Collecting\Veeam.Retriever.exe",
"Collecting\Veeam.Reporter.GrpcShared.dll",
"Reporting\Veeam.Reporter.Reporting.exe",
“Reporting\Veeam.Reporter.GrpcShared.dll”
)
Dictionary of known file hash values
$hashList = @{
“Veeam.Reporter.GrpcService.dll” = @{
“SHA1” = @("269AFC1424BC58612AC97B08520473FEEF518D4A", "B6B4404D50817EB73927F211A570767D6A0D3DE0", “990A1BAB5C408DC2CB53B2637E4FABCBDB943E96”)
}
“Veeam.Reporter.WebApiService.dll” = @{
“SHA1” = @("4406F2F4F6D7F07811946D2637DD8BB8322E91E0", "28A7D7411EF41E939D1B8D6F669966EDB1C61B12", “1957C5C23C89348A9F0B9405CECC3C2985F858BB”)
}
“Veeam.Reporter.PackInstaller.dll” = @{
“SHA1” = @("B02B20BB6E45E7E9DB2D68E8FDDAADF0ADA4BCF5", "CEB6EFCCB4CCA079501BE7A6DA225F2126761044", “717F85C39D2FAB41D720ABDDAB69B03C3AAD5ADD”)
}
“Veeam.Reporter.GrpcShared.dll” = @{
“SHA1” = @(“F0ADE6C781D673B9DB84F14AD0C2D0BE847873BD”)
}
“Collecting\Veeam.Retriever.exe” = @{
“SHA1” = @("8FCA25B1CD81D89E3B0A977B8AF5255487610969", "21D989ACF3AA191079D40FDAE06AE1B8AFBC9C8F", “AE9EE91C786D097F65B8CB26CCA253E1B4724C2C”)
}
“Collecting\Veeam.Reporter.GrpcShared.dll” = @{
“SHA1” = @(“AC5A2945728E8C60BCF4E879BCAC6B235F38B5B3”)
}
“Reporting\Veeam.Reporter.Reporting.exe” = @{
“SHA1” = @("D1EC3C8E25C654106481F7DF9281BB271461E7AD", "7359FE86A6160EF1C0C9CA913E7216DA622D6F32", “DDBE4199AA973CDD71A4F3A68B5B68CD109BFF1D”)
}
“Reporting\Veeam.Reporter.GrpcShared.dll” = @{
“SHA1” = @(“827E1929916972E6ABA25DDA15F0CD5474EBBFB8”)
}
}
Creat array to store table data
$tableData = @()
Check files and collect data for the table
foreach ($file in $fileList) {
# Skip checking Veeam.Reporter.GrpcShared.dll for builds 11.0.1.1880 or 11.0.0.1379 as that file was only relevant to 12.0.1.2591.
if ($file -like “*Veeam.Reporter.GrpcShared.dll”) {
$fileVersion = (Get-Item (Join-Path -Path $rootFolder -ChildPath $file)).VersionInfo.FileVersion
if ($fileVersion -eq “11.0.0.1379” -or $fileVersion -eq “11.0.1.1880”) {
continue
}
}
$filePath = Join-Path -Path $rootFolder -ChildPath $file
$fileDetails = $hashList[$file]
# identify file version and determine SHA1 hash
if (Test-Path $filePath) {
$fileVersion = (Get-Item $filePath).VersionInfo.FileVersion
$fileSHA1 = Get-FileHash -Path $filePath -Algorithm SHA1 | Select-Object -ExpandProperty Hash
$hashVerified = $false
# compare file on disk hash to known hotfix hash values
foreach ($hash in $fileDetails.SHA1) {
if ($fileSHA1 -eq $hash) {
$hashVerified = $true
break
}
}
} else {
$fileVersion = "N/A"
$hashVerified = $false
}
# Create an object for each file and add it to the table data array
$fileData = [PSCustomObject]@{
FileName = $file
Version = $fileVersion
"HotFix Installed" = $hashVerified
}
$tableData += $fileData
}
Display the table
$tableData | Format-Table -AutoSize
Related news
Veeam has released security updates to address four flaws in its ONE IT monitoring and analytics platform, two of which are rated critical in severity. The list of vulnerabilities is as follows - CVE-2023-38547 (CVSS score: 9.9) - An unspecified flaw that can be leveraged by an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration