Netwrix Auditor Bug Could Lead to Active Directory Domain Compromise
IT asset tracker and auditor software has a critical issue with insecure object deserialization that could allow threat actors to execute code, researchers say.
![Bug on a computer circuit board to illustrate a code vulnerability Bug on a computer circuit board to illustrate a code vulnerability](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt844ed61ddc8bdeaa/64f1740230457d6b1d118f0a/Bug_the_lightwriter_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Editor's note: Update at bottom of story.
Netwrix IT asset tracker and compliance auditor, used across more than 11,500 organizations, contains a critical Insecure Object Deserialization vulnerability that could lead to Active Directory domain compromise, a new advisory warns.
The CVE is pending, according to Bishop Fox, which just released details of the vulnerability, which affects all older supported versions of the Netwrix application versions, back to 9.96.
Organizations should immediately update their Netwrix applications to the latest version, 10.5, released on June 6, to protect their systems, the researchers urge.
The bug was discovered by an nmap TCP port scan of a Netwrix Auditor server, the Bishop Fox alert says. "The Netwrix Auditor application is affected by an insecure object deserialization issue that allows an attacker to execute arbitrary code with the privileges of the affected service," the Bishop Fox team says. "In a typical real-world scenario, Netwrix Auditor services would be running with a highly privileged account, which could lead to full compromise of the Active Directory environment."
UPDATE, July 18:
“Upon receiving the vulnerability report from Jordan Parkin of Bishop Fox, the Netwrix development team worked diligently to remediate it. On June 6, 2022, Netwrix released Netwrix Auditor 10.5 which included a fix for this vulnerability, and published a security advisory to its customers advising them of the risk and the need to upgrade. Netwrix thanks Mr. Parkin for his collaboration and coordinated disclosure of this vulnerability. Customers requiring assistance deploying Netwrix Auditor 10.5 should contact the support team via the customer web portal or by phone in the US at +1.888.638.9749.”
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024