CVE-2024-25724
📋 TL;DR
A buffer overflow vulnerability in RTI Connext Professional's XML parsing allows attackers to execute arbitrary code, leak sensitive information, or crash affected services. This affects Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service in versions 5.3.1 through 6.1.0. Attackers can exploit this via malicious RTPS messages, compromised API calls, or local malicious XML files.
💻 Affected Systems
- RTI Connext Professional Routing Service
- RTI Connext Professional Recording Service
- RTI Connext Professional Queuing Service
- RTI Connext Professional Cloud Discovery Service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with service privileges leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Service crashes causing denial of service, potential information disclosure from memory leaks, and limited code execution in constrained environments.
If Mitigated
Service disruption from crashes with no data loss if proper network segmentation and least privilege are implemented.
🎯 Exploit Status
Remote exploitation via RTPS messages requires network access but no authentication. Local exploitation requires file system access or compromised API calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.1
Vendor Advisory: https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/index.html#cve-2024-25724
Restart Required: Yes
Instructions:
1. Download RTI Connext Professional 6.1.1 or later from RTI's official distribution channels. 2. Stop all affected services. 3. Install the updated version following RTI's installation guide. 4. Restart services with the patched version.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected services from untrusted networks and restrict RTPS traffic to trusted sources only.
File System Controls
linuxImplement strict file permissions and monitoring on directories containing XML configuration files.
chmod 600 /path/to/config/files/*.xml
chown root:root /path/to/config/files/*.xml
🧯 If You Can't Patch
- Implement strict network access controls to limit RTPS traffic to trusted sources only.
- Monitor service logs for abnormal behavior and implement file integrity monitoring on XML configuration files.
🔍 How to Verify
Check if Vulnerable:
Check the installed version of RTI Connext Professional. If version is between 5.3.1 and 6.1.0 inclusive, the system is vulnerable.Check Version:
rtiddsgen -versionVerify Fix Applied:
Confirm installation of version 6.1.1 or later and verify services are running with the updated binaries.📡 Detection & Monitoring
Log Indicators:
- Service crashes with segmentation faults or access violations
- Unusual XML parsing errors in service logs
- Abnormal memory usage patterns before service termination
Network Indicators:
- Malformed RTPS packets targeting vulnerable services
- Unexpected XML content in network traffic to service ports
SIEM Query:
source="*rti*" AND (event_type="crash" OR error="segmentation fault" OR error="buffer overflow")