Black Arrow Cyber Advisory 19/07/2022 – Netwrix Auditor – RCE and Privilege Escalation Vulnerability

Executive Summary

Netwrix Auditor is an application that allows an organisation to monitor their IT infrastructure. A newly discovered vulnerability could allow malicious actors to execute arbitrary code on affected servers which are running the application. This vulnerability can also allow for privilege escalation on the server as the malicious code can be executed with “System” level permissions. This software is currently in use by more than 11,000 organisations across the globe.

What’s the risk to me or my business?

Managed service providers and IT Teams use software to assist in monitoring various elements of IT Infrastructure, including Active Directory. If Netwrix Auditor is currently being used by your organisation, then this vulnerability could potentially be exploited to execute code remotely, allowing them to run malicious software to further compromise affected devices.

What can I do?

An update, version 10.5, has been released by Netwrix Auditor to address the issue, this should be applied to all current deployments of the software tool. This specific vulnerability is accessed using an exposed network port, appropriately configured external perimeter controls could be used to mitigate the risk, however the vulnerability could still be used if an attacker manages to gain access to the organisations network.

Technical Summary

This specific vulnerability relates to an unsecured .NET remoting service which can be accessed via TCP port 9004 on the server which Netwrix Auditor is installed. While this vulnerability is yet to be given an official CVE, Bishop Fox, the firm which published details on the vulnerability has rated this as Critical, since it can be executed remotely and can lead to escalation of privileges and code execution.

Further information on this particular vulnerability is available here: Netwrix Auditor Bug Threatens Active Directory Domain - Blumira

Need help understanding your gaps, or just want some advice? Get in touch with us.