CVE-2022-31199 Netwrix Auditor Insecure Object Deserialization
Unauthenticated remote attackers can execute arbitrary code as SYSTEM via deserialization flaws in the Netwrix Auditor video recording component.
- Exploited in the wild
- Since 11 Jul 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31199?
CVE-2022-31199 is a critical unsafe deserialization vulnerability in n/a, published on 8 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.
Weakness: CWE-502
Which versions are affected by CVE-2022-31199?
It affects 1 product.
Products include Netwrix Auditor.
How do I fix CVE-2022-31199?
No fix has been published for CVE-2022-31199 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 1 Aug 2023.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-31199 being exploited?
Yes. Attackers have exploited CVE-2022-31199 in the wild since at least 11 Jul 2023, including in ransomware campaigns.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c3rc-wfgg-r544.