Patchfirst
Patchfirst
CVE-2022-31199 KEVRansomwarePublic exploit Critical · 9.8 EPSS 36.0%

Netwrix Auditor Insecure Object Deserialization Vulnerability

Netwrix · Auditor

Summary

Netwrix Auditor contains a remote code execution flaw in the User Activity Video Recording component, affecting both the Auditor server and the agents installed on monitored systems, stemming from weaknesses in the underlying protocol the component uses. An unauthenticated remote attacker with network access can exploit it, without user interaction, to run arbitrary code as NT AUTHORITY\SYSTEM on affected systems, including monitored hosts.

Official description · NVD

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

Breakdown
83.4 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 30 days after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidenceNamed in a threat reportblog.talosintelligence.com+30 days
  3. Added to CISA KEVknown ransomware use; EU database agrees+8 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Unauthenticated remote exploitation of network-exposed component

potentially allow an unauthenticated remote attacker to execute arbitrary code
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

Arbitrary code execution as SYSTEM

execute arbitrary code as the NT AUTHORITY\SYSTEM user
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2022-31199 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportCisco TalosDec 2022

Reports are matched by finding the exact id CVE-2022-31199 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Cisco Talos8 Dec 2022

Breaking the silence

Because multiple of these events occurred in the same timeframe on unrelated organizations, we believe with high confidence that these events are the result of the exploitation of a vulnerability in Netwrix Auditor (CVE-2022-31199) that was made public in July 2022 by Bishop Fox.

2 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-31199

Third Party Advisory 1

bishopfox.com/blog/netwrix-auditor-advisory
↑ ↓ chooseEnter openEsc close