CVE-2023-24576
📋 TL;DR
CVE-2023-24576 is an unauthenticated remote code execution vulnerability in EMC NetWorker's nsrexecd service. This allows attackers to execute arbitrary code on affected systems without authentication, potentially compromising the entire NetWorker environment. All systems running vulnerable versions of NetWorker are affected.
💻 Affected Systems
- EMC NetWorker
- Dell NetWorker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal backup data, deploy ransomware, and pivot to other systems in the network.
Likely Case
Attackers gain initial foothold on backup infrastructure, potentially accessing sensitive backup data and using the compromised system as a launch point for further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to the backup environment, though data exfiltration remains possible.
🎯 Exploit Status
The vulnerability is in the nsrdump component of nsrexecd service, allowing unauthenticated attackers to trigger code execution through specially crafted requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.10.0.2 and later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000208258/dsa-2023-041-dell-networker-security-update-for-nsrdump-vulnerability
Restart Required: Yes
Instructions:
1. Download the patch from Dell Support site. 2. Apply the patch following Dell's installation guide. 3. Restart NetWorker services. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to nsrexecd service (ports 7937-9937) to only trusted management systems.
iptables -A INPUT -p tcp --dport 7937:9937 -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 7937:9937 -j DROP
Service Disablement
linuxTemporarily disable the nsrexecd service if not required for operations.
systemctl stop nsrexecd
systemctl disable nsrexecd
🧯 If You Can't Patch
- Implement strict network segmentation to isolate NetWorker systems from untrusted networks
- Deploy host-based firewalls to restrict access to nsrexecd ports (7937-9937) to only authorized management systems
🔍 How to Verify
Check if Vulnerable:
Check NetWorker version: nsr -v or check installed packages. If version is below 19.10.0.2, system is vulnerable.Check Version:
nsr -vVerify Fix Applied:
Verify version is 19.10.0.2 or higher and check that nsrexecd service is running with the updated binary.📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 7937-9937
- Unexpected process execution from nsrexecd
- Failed authentication attempts to nsrexecd service
Network Indicators:
- Unusual traffic patterns to/from port 7937-9937
- Connection attempts from unauthorized IPs to nsrexecd ports
SIEM Query:
source_port:7937-9937 OR destination_port:7937-9937 AND (process_name:nsrexecd OR service_name:nsrexecd)