CVE-2024-5671: Trellix IPS Manager RCE Vulnerability

CVE-2024-5671 Overview

CVE-2024-5671 is an insecure deserialization vulnerability affecting certain workflows within the Trellix IPS Manager. This critical flaw allows unauthenticated remote attackers to execute arbitrary code and gain unauthorized access to vulnerable Trellix IPS Manager installations. The vulnerability stems from improper handling of serialized data (CWE-502), a common weakness that can lead to devastating consequences when exploited.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on vulnerable Trellix IPS Manager systems, potentially compromising the entire security infrastructure and gaining full system access without any authentication requirements.

Affected Products

• Trellix IPS Manager (specific versions detailed in Trellix Security Advisory)

Discovery Timeline

• June 14, 2024 - CVE-2024-5671 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-5671

Vulnerability Analysis

This insecure deserialization vulnerability exists within certain workflows of the Trellix IPS Manager application. The flaw allows attackers to submit malicious serialized objects that are processed by the application without proper validation. When the application deserializes these malicious objects, it can be manipulated to execute arbitrary code on the underlying system.

The vulnerability is particularly severe because it requires no authentication to exploit. An attacker with network access to the vulnerable IPS Manager can craft and send malicious serialized payloads to trigger code execution. Given that IPS Manager is a security management platform, successful exploitation could allow attackers to disable security controls, pivot to other network segments, or gain persistent access to the environment.

Root Cause

The root cause of CVE-2024-5671 is insecure deserialization (CWE-502) in the Trellix IPS Manager's workflow processing components. The application fails to properly validate or sanitize serialized data before deserialization, allowing attackers to inject malicious object graphs that execute arbitrary code upon being deserialized by the Java runtime or similar serialization frameworks.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an exposed Trellix IPS Manager instance accessible over the network
2. Crafting a malicious serialized payload containing gadget chains that achieve code execution
3. Submitting the payload to the vulnerable workflow endpoint
4. Upon deserialization, the malicious object executes attacker-controlled code with the privileges of the IPS Manager process

The vulnerability affects specific workflows in the application. For detailed technical information and affected versions, refer to the Trellix Security Advisory.

Detection Methods for CVE-2024-5671

Indicators of Compromise

• Unusual network connections originating from the IPS Manager server to external or unexpected internal destinations
• Unexpected processes spawned by the IPS Manager application or its parent process
• Anomalous serialized data payloads in network traffic targeting IPS Manager endpoints
• Unauthorized modifications to IPS Manager configuration files or system binaries
• Log entries indicating failed or successful exploitation attempts against workflow endpoints

Detection Strategies

• Monitor network traffic for suspicious serialized Java objects or known deserialization gadget chains targeting IPS Manager
• Implement web application firewall (WAF) rules to detect and block common deserialization attack patterns
• Enable verbose logging on the IPS Manager and forward logs to a SIEM for correlation and analysis
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to detect post-exploitation activities

Monitoring Recommendations

• Continuously monitor the IPS Manager server for unexpected process creation or network activity
• Set up alerts for authentication bypass attempts or access to workflow endpoints from untrusted sources
• Review IPS Manager logs regularly for error messages that may indicate deserialization failures or exploitation attempts
• Monitor system integrity to detect unauthorized file modifications on the IPS Manager host

How to Mitigate CVE-2024-5671

Immediate Actions Required

• Apply the security patch provided by Trellix immediately as documented in Trellix Article 000013623
• Restrict network access to the IPS Manager to only trusted management networks using firewall rules
• Implement network segmentation to limit the blast radius if exploitation occurs
• Enable additional logging and monitoring on IPS Manager systems to detect potential attacks

Patch Information

Trellix has released a security update addressing CVE-2024-5671. Organizations should consult the official Trellix Security Advisory for specific patch versions, download locations, and installation instructions. Due to the critical nature of this vulnerability and its potential for unauthenticated remote code execution, patching should be prioritized immediately.

Workarounds

• If patching is not immediately possible, isolate the IPS Manager from untrusted network segments using strict firewall rules
• Implement reverse proxy or WAF protection in front of the IPS Manager to filter potentially malicious requests
• Limit network access to the IPS Manager management interface to only authorized administrator workstations
• Consider temporarily disabling affected workflow endpoints if they are not business-critical (consult Trellix documentation)

# Example: Restrict IPS Manager access to trusted management network using iptables
# Replace 10.10.10.0/24 with your actual management network CIDR
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP