PT-2019-13903 · Netwrix · Netwrix Auditor

Hashim Jawad · Published 2019-08-12 · Updated 2020-08-24 · CVE-2019-14969

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netwrix Auditor versions prior to 9.8

Description The issue is related to insecure permissions on certain directories and sub-folders, specifically %PROGRAMDATA%Netwrix AuditorLogsActiveDirectory. The Netwrix.ADA.StorageAuditService service, which writes to this directory, does not properly impersonate, resulting in the target file having the same permissions as the invoking process. This allows low-privileged users to perform DLL Hijacking/Binary Planting attacks, potentially executing code as NT AUTHORITYSYSTEM with the help of Symbolic Links.

Recommendations For versions prior to 9.8, update to version 9.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the %PROGRAMDATA%Netwrix AuditorLogsActiveDirectory directory and its sub-folders to prevent low-privileged users from exploiting the vulnerability. Additionally, restrict the use of the Netwrix.ADA.StorageAuditService service until the update is applied.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2019-14969

Affected Products

Netwrix Auditor

References · 3

• https://osv.dev/vulnerability/CVE-2019-14969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14969 · Security Note
• https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-010.md · Note