CVE-2023-24576: Dell EMC NetWorker RCE Vulnerability

CVE-2023-24576 Overview

Dell EMC NetWorker contains a critical unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd). This vulnerability allows remote attackers to execute arbitrary code on affected systems without requiring any authentication, regardless of the authentication mechanisms configured on the target system.

Critical Impact

Unauthenticated attackers can remotely execute arbitrary code on Dell EMC NetWorker clients, potentially compromising enterprise backup infrastructure and gaining access to sensitive data across the organization.

Affected Products

• Dell EMC NetWorker (Virtual Edition)
• Dell EMC NetWorker version 19.7.0.2
• Dell EMC NetWorker (multiple versions with vulnerable nsrexecd service)

Discovery Timeline

• 2023-02-03 - CVE-2023-24576 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-24576

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The flaw exists in the NetWorker Client execution service (nsrexecd), which is responsible for handling remote command execution requests from the NetWorker server during backup and recovery operations.

The critical nature of this vulnerability stems from the fact that the authentication bypass works irrespective of any authentication mechanisms configured on the system. This means that even in environments where authentication is properly configured and enforced, an attacker can still exploit this vulnerability to execute arbitrary commands with the privileges of the nsrexecd service.

Root Cause

The root cause of this vulnerability is improper input validation and insufficient authentication enforcement within the nsrexecd service. The service fails to properly verify the legitimacy of incoming requests before processing them, allowing unauthenticated remote requests to be executed as if they were legitimate backup operations.

This represents a fundamental flaw in how the service handles the authentication state, where the authentication check can be bypassed entirely, allowing an attacker to craft malicious requests that the service will execute without verifying the caller's identity.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker with network access to the nsrexecd service (typically running on port 7937-7938) can send specially crafted requests to trigger the vulnerability. The attack requires no privileges and can be executed remotely.

The exploitation scenario typically involves:

1. Identifying NetWorker clients with the vulnerable nsrexecd service exposed on the network
2. Crafting malicious requests that bypass the authentication mechanism
3. Sending the payload to execute arbitrary commands on the target system
4. Gaining code execution with the privileges of the nsrexecd service process

Due to the nature of backup infrastructure, compromised NetWorker clients may have access to sensitive data and could serve as pivot points for lateral movement within the enterprise network.

Detection Methods for CVE-2023-24576

Indicators of Compromise

• Unexpected network connections to nsrexecd service ports (typically 7937-7938) from unauthorized sources
• Anomalous process execution spawned from the nsrexecd service process
• Unusual command-line arguments or child processes associated with NetWorker services
• Unexpected modifications to backup configuration files or schedules

Detection Strategies

• Monitor network traffic for unusual connections to NetWorker service ports from non-NetWorker server IP addresses
• Implement endpoint detection rules to alert on suspicious child processes spawned by nsrexecd
• Deploy network intrusion detection signatures to identify exploitation attempts targeting the nsrexecd service
• Review NetWorker service logs for authentication failures or unusual request patterns

Monitoring Recommendations

• Configure SIEM rules to correlate NetWorker service activity with network connection events
• Enable detailed logging for the nsrexecd service to capture request metadata
• Implement network segmentation monitoring to detect lateral movement from compromised backup clients
• Set up alerts for any command execution originating from NetWorker services outside of scheduled backup windows

How to Mitigate CVE-2023-24576

Immediate Actions Required

• Apply the security update provided in Dell Security Advisory DSA-2023-041 immediately
• Restrict network access to nsrexecd service ports to only authorized NetWorker servers
• Audit all NetWorker client installations to identify vulnerable versions
• Review network logs for any signs of prior exploitation attempts

Patch Information

Dell has released a security update to address this vulnerability. Organizations should consult Dell Security Advisory DSA-2023-041 for the specific patched versions applicable to their environment and follow the vendor's recommended upgrade path.

It is critical to prioritize patching of internet-facing or externally accessible NetWorker clients, followed by internal systems based on their criticality and exposure.

Workarounds

• Implement strict firewall rules to limit access to nsrexecd ports (7937-7938) to only known NetWorker server IP addresses
• Consider temporarily disabling the nsrexecd service on non-critical clients until patches can be applied
• Deploy network segmentation to isolate backup infrastructure from general network access
• Enable enhanced logging and monitoring on all NetWorker components to detect exploitation attempts

# Example firewall configuration to restrict nsrexecd access (Linux iptables)
# Replace NETWORKER_SERVER_IP with your actual NetWorker server IP address
iptables -A INPUT -p tcp --dport 7937:7938 -s NETWORKER_SERVER_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 7937:7938 -j DROP