CVE-2024-53915: Veritas Enterprise Vault RCE Vulnerability

CVE-2024-53915 Overview

CVE-2024-53915 is a critical insecure deserialization vulnerability in Veritas Enterprise Vault that allows remote attackers to execute arbitrary code on affected systems. The vulnerability exists in the server component where untrusted data received on a .NET Remoting TCP port is deserialized without proper validation, enabling attackers to craft malicious serialized objects that execute arbitrary commands upon deserialization.

Critical Impact

This vulnerability enables unauthenticated remote code execution through malicious .NET Remoting payloads, potentially allowing complete system compromise of Veritas Enterprise Vault servers without any user interaction.

Affected Products

• Veritas Enterprise Vault versions prior to 15.2

Discovery Timeline

• 2024-11-24 - CVE-2024-53915 published to NVD
• 2024-11-29 - Last updated in NVD database

Technical Details for CVE-2024-53915

Vulnerability Analysis

This vulnerability (tracked as ZDI-CAN-24405) stems from improper handling of deserialization operations within the Veritas Enterprise Vault server component. The server exposes a .NET Remoting TCP endpoint that accepts serialized objects from network connections. When processing incoming data, the application fails to adequately validate or restrict the types of objects being deserialized, creating an opportunity for attackers to inject malicious payloads.

.NET Remoting is a legacy inter-process communication framework that has known security concerns when exposed to untrusted input. In this case, the Enterprise Vault server accepts serialized .NET objects over TCP without implementing proper type filtering or input validation, making it susceptible to object injection attacks.

Root Cause

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The Veritas Enterprise Vault server processes serialized data from network connections without implementing adequate security controls such as:

• Type whitelisting or blacklisting for deserialization
• Input validation before deserialization occurs
• Isolation of the deserialization context
• Authentication requirements for the .NET Remoting endpoint

This allows attackers to craft malicious serialized payloads containing dangerous object types that execute code during the deserialization process.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the vulnerable .NET Remoting TCP port can send specially crafted serialized payloads to the Enterprise Vault server. Upon receiving these payloads, the server automatically deserializes the data, triggering the execution of attacker-controlled code with the privileges of the Enterprise Vault service account.

The exploitation process typically involves:

1. Identifying the exposed .NET Remoting TCP port on the target system
2. Crafting a malicious serialized object using known .NET deserialization gadget chains
3. Sending the payload to the vulnerable endpoint
4. Achieving code execution as the server processes the malicious object

Detection Methods for CVE-2024-53915

Indicators of Compromise

• Unusual network connections to the Veritas Enterprise Vault .NET Remoting TCP port from external or unexpected sources
• Suspicious process spawning or command execution originating from the Enterprise Vault service process
• Anomalous file system activity or registry modifications by the Enterprise Vault server process
• Evidence of known .NET deserialization gadget chain artifacts in network traffic or memory

Detection Strategies

• Monitor network traffic for .NET Remoting binary serialization patterns directed at Enterprise Vault servers
• Implement network segmentation rules to alert on unauthorized access attempts to Enterprise Vault service ports
• Deploy endpoint detection solutions to identify suspicious child processes spawned by the Enterprise Vault service
• Review Windows Event Logs for unusual application errors or process execution events related to Enterprise Vault

Monitoring Recommendations

• Configure SIEM rules to correlate network connections to Enterprise Vault ports with subsequent process creation events
• Enable detailed logging for the Enterprise Vault server and forward logs to centralized monitoring
• Implement behavioral analysis to detect anomalous activity patterns from Enterprise Vault service accounts
• Regularly audit network access controls to ensure only authorized systems can communicate with Enterprise Vault servers

How to Mitigate CVE-2024-53915

Immediate Actions Required

• Upgrade Veritas Enterprise Vault to version 15.2 or later immediately
• Implement network segmentation to restrict access to the Enterprise Vault .NET Remoting TCP port to only trusted systems
• Apply firewall rules to block external access to the vulnerable service port
• Monitor Enterprise Vault servers for signs of exploitation while patching is in progress

Patch Information

Veritas has released version 15.2 of Enterprise Vault to address this vulnerability. Organizations should review the Veritas Security Advisory VTS24-014 for complete patch details and upgrade instructions. The patch implements proper input validation and security controls for the .NET Remoting endpoint.

Workarounds

• Restrict network access to the Enterprise Vault .NET Remoting TCP port using host-based or network firewalls
• Consider disabling unnecessary .NET Remoting endpoints if not required for business operations
• Implement network monitoring and alerting for connections to the vulnerable service port
• Deploy application control solutions to limit process execution capabilities of the Enterprise Vault service account

# Example: Windows Firewall rule to restrict access to Enterprise Vault port (adjust port number as needed)
netsh advfirewall firewall add rule name="Block External EV Remoting" dir=in action=block protocol=tcp localport=<EV_REMOTING_PORT> remoteip=any
netsh advfirewall firewall add rule name="Allow Internal EV Remoting" dir=in action=allow protocol=tcp localport=<EV_REMOTING_PORT> remoteip=<TRUSTED_IP_RANGE>