Netwrix Auditor Insecure Object Deserialization Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-07-11
• Known to be used in ransomware campaigns
• EPSS: 36% chance of exploitation in the next 30 days (higher than 98% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

CISA: Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 1 Aug 2023): Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• bishopfox.com/blog/netwrix-auditor-advisoryExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource