Authenticated code execution via unsafe .NET deserialization
Published May 30, 2024 · Updated Sep 3, 2024
Unsafe .NET object deserialization in Dassault Systèmes DELMIA Apriso 2019 through 2024 allows remote authenticated users to execute code. The product reconstructs attacker-controlled .NET objects without a disclosed validation boundary; the affected endpoint, class, method, and payload field remain unpublished. A valid low-privilege account, network reachability, and high-complexity conditions are required; successful exploitation runs attacker-controlled code across a changed security boundary.
Summary
What happened
Unsafe .NET object deserialization in Dassault Systèmes DELMIA Apriso 2019 through 2024 allows remote authenticated users to execute code. The product reconstructs attacker-controlled .NET objects without a disclosed validation boundary; the affected endpoint, class, method, and payload field remain unpublished. A valid low-privilege account, network reachability, and high-complexity conditions are required; successful exploitation runs attacker-controlled code across a changed security boundary.
The record
- CVE
- CVE-2024-3301
- Published
- May 30, 2024
- Updated
- Sep 3, 2024
- Vendor
- Dassault Systèmes
- Product
- DELMIA Apriso
- Classifications
- CWE-502, CAPEC-586
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- May 30, 2024CVE publishedPublication date reported by the CVE source.
- Sep 3, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=2019 <=2024
- Affected versionversion=Release 2019 Golden <=Release 2019 SP5
- Affected versionversion=Release 2020 Golden <=Release 2020 SP4
- Affected versionversion=Release 2021 Golden <=Release 2021 SP3
- Affected versionversion=Release 2022 Golden <=Release 2022 SP3
- Affected versionversion=Release 2023 Golden <=Release 2023 SP2
- Affected versionversion=Release 2024 Golden <=Release 2024 SP1
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo