Unauthenticated Password Reset Link Hijacking in Veeam Service Provider Console

Executive Summary

This vulnerability involves improper handling of the returnUrl parameter in Veeam Service Provider Console's Forgot Password function. An unauthenticated attacker can manipulate the domain of the password reset link. When a user clicks the link, the reset code is sent to an attacker-controlled server, allowing account takeover.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper handling of the returnUrl parameter in Veeam Service Provider Console's Forgot Password function. To detect it, monitor network traffic for password reset links with attacker-controlled domains. Check VSPC logs for unusual reset link generation or email delivery to unexpected hosts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could intercept password reset codes, gain unauthorized access to user accounts, and potentially steal sensitive data or perform actions on behalf of the compromised user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately review and validate all password reset links generated by the Forgot Password function. Ensure the returnUrl parameter does not redirect to external domains. Disable or restrict unauthenticated access to password reset functionality until a patch is applied.

Useful 0 Not Useful 0