Listen to this Post
CVE-2022-31199 is a critical remote code execution vulnerability located within the User Activity Video Recording (UAVRServer) component of Netwrix Auditor.
The core flaw originates from an unsecured .NET remoting service listening directly on TCP port 9004.
The application fails to implement a proper type allowlist when handling incoming network streams via the standard .NET binary formatter.
Because object deserialization is entirely unconstrained, an unauthenticated remote attacker can transmit maliciously constructed payload objects.
These objects leverage known gadget chains available within the .NET framework or underlying application assemblies during the graph reconstruction phase.
When the deserialization process completes, it executes arbitrary commands or binaries under the context of the running service account.
On standard enterprise installations, this specific service operates with the highest level of privileges as NT AUTHORITY\SYSTEM.
An adversary situated on the network can reach this listening port directly without needing any prior credentials or user interaction.
Furthermore, because Netwrix Auditor installs monitoring agents across multiple endpoints in an enterprise domain, the risk spans widely.
Compromising the primary server or any managed agent allows an attacker to pivot into the wider network infrastructure easily.
Mitigation requires updating affected server and agent installations immediately alongside network-level segmentation of port 9004.
DailyCVE Form:
Platform: Netwrix Auditor
Version: Prior to 10.5
Vulnerability: Insecure Deserialization
Severity: Critical
date: November 8 2022
Prediction: Released November 2022
What Undercode Say:
netstat -ano | findstr 9004 python3 -m ysoserial.net -g TextFormattingRunProperties -c "whoami > C:\temp\out.txt" python3 ExploitRemotingService.py target_ip 9004 payload.bin
Exploit: (Educational Purposes!)
An unauthenticated attacker connects to TCP port 9004 running the UAVRServer service. Using tools like ysoserial.net, a malicious .NET serialized object containing a specific gadget chain is generated. This payload is then transmitted over the .NET remoting protocol. Upon reception, the server deserializes the object without validation, triggering the execution of system commands with `NT AUTHORITY\SYSTEM` privileges.
Protection: from this CVE
Update Netwrix Auditor to version 10.5 or later where deserialization filters and allowlists are properly enforced. Restrict network access to TCP port 9004 using host firewalls and network segmentation so that only authorized management hosts can communicate with the service. Audit all endpoints for unexpected service installations, scheduled tasks, or anomalous process executions.
Impact:
Total compromise of the Netwrix Auditor server and all monitored systems running the agent. Attackers achieve unauthenticated remote code execution with `NT AUTHORITY\SYSTEM` privileges, enabling complete domain takeover, sensitive data theft, ransomware deployment, and severe lateral movement across enterprise networks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
