CVE-2024-3300: DELMIA Apriso RCE Vulnerability

CVE-2024-3300 Overview

CVE-2024-3300 is a critical insecure deserialization vulnerability affecting DELMIA Apriso, a manufacturing execution system (MES) developed by Dassault Systèmes. The vulnerability stems from unsafe .NET object deserialization that allows attackers to achieve pre-authentication remote code execution on affected systems. This vulnerability poses significant risk to industrial and manufacturing environments where DELMIA Apriso is deployed for production management.

Critical Impact

Pre-authentication remote code execution allows unauthenticated attackers to execute arbitrary code on vulnerable DELMIA Apriso systems, potentially compromising manufacturing operations and sensitive production data.

Affected Products

• DELMIA Apriso Release 2019
• DELMIA Apriso Release 2020 through Release 2023
• DELMIA Apriso Release 2024

Discovery Timeline

• 2024-05-30 - CVE-2024-3300 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-3300

Vulnerability Analysis

This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The core issue lies in how DELMIA Apriso processes serialized .NET objects from untrusted sources without proper validation. When an application deserializes data without verifying its integrity or origin, attackers can craft malicious serialized objects that execute arbitrary code upon deserialization.

The pre-authentication nature of this vulnerability is particularly concerning, as it does not require any form of user authentication to exploit. An attacker with network access to the vulnerable DELMIA Apriso instance can send specially crafted serialized payloads directly to the application.

The high EPSS score of 32.012% (96.817th percentile) indicates a significant probability of exploitation in the wild, reflecting the attractiveness of this vulnerability to threat actors targeting industrial systems.

Root Cause

The root cause is the use of unsafe .NET deserialization mechanisms that process untrusted user input. The application fails to implement proper safeguards such as type filtering, serialization binders, or input validation before deserializing incoming data streams. This allows attackers to inject malicious object graphs that leverage .NET gadget chains to achieve code execution.

Attack Vector

The attack vector is network-based and does not require authentication. An attacker can exploit this vulnerability by sending a crafted HTTP request containing a malicious serialized .NET object to the DELMIA Apriso web interface. Upon deserialization, the malicious payload executes with the privileges of the application process.

Common .NET deserialization gadget chains such as those found in libraries like ObjectDataProvider, TypeConfuseDelegate, or PSObject can be leveraged to construct exploitation payloads. Tools like ysoserial.net are commonly used to generate these malicious serialized objects targeting vulnerable .NET applications.

Detection Methods for CVE-2024-3300

Indicators of Compromise

• Unusual HTTP POST requests to DELMIA Apriso endpoints containing base64-encoded or binary serialized .NET objects
• Unexpected process spawning from the DELMIA Apriso application process (e.g., cmd.exe, powershell.exe)
• Network connections from the DELMIA Apriso server to unknown external IP addresses
• Presence of known .NET deserialization gadget chain signatures in network traffic or logs

Detection Strategies

• Deploy network intrusion detection rules to identify serialized .NET object patterns in HTTP traffic to DELMIA Apriso systems
• Monitor application logs for deserialization errors or exceptions that may indicate exploitation attempts
• Implement endpoint detection rules to alert on suspicious child processes spawned by the DELMIA Apriso service account
• Review web application firewall logs for anomalous POST request payloads targeting Apriso endpoints

Monitoring Recommendations

• Enable verbose logging on DELMIA Apriso servers and centralize logs in a SIEM for correlation analysis
• Configure network segmentation monitoring to detect lateral movement from compromised Apriso systems
• Establish baseline behavior for Apriso server processes and alert on deviations
• Monitor for file system changes in the DELMIA Apriso installation directories

How to Mitigate CVE-2024-3300

Immediate Actions Required

• Identify all DELMIA Apriso installations running Release 2019 through Release 2024 in your environment
• Apply network segmentation to restrict access to DELMIA Apriso servers from untrusted networks
• Implement web application firewall rules to filter potentially malicious serialized payloads
• Review and restrict service account privileges for DELMIA Apriso to limit impact of potential compromise

Patch Information

Dassault Systèmes has published security advisory information for this vulnerability. Organizations should consult the 3DS Security Advisories page for specific patch versions and remediation guidance. Apply the latest security updates from Dassault Systèmes as soon as they become available.

Workarounds

• Implement strict network access controls to limit connectivity to DELMIA Apriso servers to authorized systems only
• Deploy a web application firewall (WAF) with rules designed to detect and block .NET deserialization attacks
• Consider implementing virtual patching through IPS/IDS signatures until official patches can be applied
• If feasible, disable or restrict access to vulnerable endpoints identified in the security advisory

# Network segmentation example - restrict access to Apriso server
# Example iptables rules to limit access to trusted networks only
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP