CVE-2022-31199

CRITICALCISA KEVRansomware

Netwrix Auditor Insecure Object Deserialization Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-31199 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 3 lab environments. CISA lists CVE-2022-31199 in KEV and reports its use in known ransomware campaigns.

Description

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Jul 11, 2023 · CISA
VulnCheck KEV
Listed · Dec 8, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · CISA

Available material

Repository PoCs
1
Lab environments
3

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 9, 2023 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Auditor

Browse Netwrix / Auditor
CISAVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubdeveloperfred/CVE-2022-31199Repository PoCby developerfred0Scanner19 files

98.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a lab environment and toolset for CVE-2022-31199. The primary executable code (test_exploit.py) performs vulnerability detection and service fingerprinting by sending a .NET Remoting probe and checking for indicators in the response. It does not contain a working deserialization payload or achieve remote code execution; it explicitly states that real exploitation requires external tools like ysoserial.net. The repository also includes a Nuclei template (CVE-2022-31199.yaml) for network scanning.

Backdoor review

No backdoor observed in reviewed code

The repository contains a lab environment, documentation, and proof-of-concept scripts for CVE-2022-31199. All reviewed code performs expected vulnerability testing and simulation behaviors: connecting to a target, sending .NET Remoting probes, and logging exploitation attempts. No concealed, deceptive, or operator-directed harmful behavior was observed.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPythonYAMLPowerShell
Target softwareNetwrix Auditor
Attack typesvulnerability scanningservice fingerprinting
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary Python script (test_exploit.py) is a vulnerability scanner. It connects to a target, sends a probe, and analyzes the response to determine if the service is vulnerable. It does not contain a working exploit payload; its 'test_exploit' function sends a dummy payload and explicitly states that real exploitation requires external tools. The repository also contains a Nuclei template (CVE-2022-31199.yaml) which is a scanner definition. The overall artifact is designed for detection and validation, not exploitation.

CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-9CVE-2022-31199-lab/exploit-tools/test_exploit.py:260-315CVE-2022-31199.yaml:1-67

Requirements

  • Network access to target payload withheldCVE-2022-31199-lab/exploit-tools/test_exploit.py:59-63

Observed behavior

  • Establishes a TCP connection to the target on port 9004CVE-2022-31199-lab/exploit-tools/test_exploit.py:59-63
  • Sends a crafted .NET Remoting probe packet containing a preamble and a System.Runtime.Remoting.Messaging referenceCVE-2022-31199-lab/exploit-tools/test_exploit.py:80-96
  • Receives the server response and checks for indicators such as '.NET', 'Remoting', 'UAVRServer', or 'Netwrix' to determine vulnerabilityCVE-2022-31199-lab/exploit-tools/test_exploit.py:99-151
  • Performs a time-based detection test by comparing response times for normal and delayed requestsCVE-2022-31199-lab/exploit-tools/test_exploit.py:165-206
  • Generates a simple, non-functional test payload for demonstration purposes and notes that real exploitation requires ysoserial.netCVE-2022-31199-lab/exploit-tools/test_exploit.py:260-315
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe test_exploit.py and vulnerable-server.py scripts connect to or listen on port 9004, which is the documented port for the Netwrix Auditor .NET Remoting service targeted by CVE-2022-31199.CVE-2022-31199-lab/exploit-tools/test_exploit.py:59-63CVE-2022-31199-lab/vulnerable-server.py:14-16
File Write
Payload withheldThe vulnerable-server.py simulator writes received exploitation attempt data to a local log file for monitoring purposes, consistent with a lab environment.CVE-2022-31199-lab/vulnerable-server.py:48-50
Review boundaries

What the analysis did not establish

  • Evidence coverage is incomplete: 11 of 19 files were omitted from the packet due to size or binary policy. The omitted files may contain additional exploit code (e.g., exploit.py, exploit.ps1) that could change the classification.
  • The analysis is based solely on the supplied text; no code was executed, and the functionality of omitted files is unknown.
  • Eleven files were omitted from the evidence packet due to text budget limits; their content was not reviewed.
  • Binary files were not present in the evidence, so no binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

3
GitHub

CVE-2022-31199-lab/docker-compose.macos.yml

developerfred/CVE-2022-31199Created Vuln labCVE-2022-31199Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that creates a vulnerable Python server simulating a .NET Remoting service and an attacker container with exploit tools, designed to demonstrate CVE-2022-31199.

CVE-2022-31199-lab/docker-compose.macos.yml:1-36CVE-2022-31199-lab/README.md:1-10

Lab assessment

Vulnerability lab

The README explicitly states the environment is a 'complete vulnerable environment for CVE-2022-31199' designed for security research and education. The Compose file defines a vulnerable server and an attacker machine with exploit tools.

CVE-2022-31199-lab/README.md:1-5CVE-2022-31199-lab/docker-compose.macos.yml:4-18
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable-server

vulnerable target.NET Remoting simulator

A Python service that listens on port 9004, simulates a .NET Remoting service, logs exploitation attempts, and responds to probes. It is the target for CVE-2022-31199 exploitation exercises.

CVE-2022-31199-lab/docker-compose.macos.yml:4-18CVE-2022-31199-lab/vulnerable-server.py:1-132

attacker

attacker machineexploit tool host

A Python container that mounts the exploit-tools directory and runs indefinitely, providing an environment to execute test_exploit.py and other scripts against the vulnerable server.

CVE-2022-31199-lab/docker-compose.macos.yml:20-33CVE-2022-31199-lab/exploit-tools/README.md:1-10
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-31199

Supported by supplied evidence

The lab is explicitly named and documented for CVE-2022-31199. The vulnerable server script references the CVE, and the exploit tools are designed to detect and test this specific vulnerability.

CVE-2022-31199-lab/README.md:1-5CVE-2022-31199-lab/vulnerable-server.py:3-5CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.CVE-2022-31199-lab/README.md:75-78
  • The vulnerable server container requires the vulnerable-server.py script to be present in the same directory as the Compose file.CVE-2022-31199-lab/docker-compose.macos.yml:10-11
  • The attacker container requires the exploit-tools directory to be present for mounting.CVE-2022-31199-lab/docker-compose.macos.yml:24-25

Evidence-described exercise path

  1. Start the lab environment using 'docker-compose -f docker-compose.macos.yml up -d'.CVE-2022-31199-lab/README.md:100-102
  2. Verify the vulnerable server is running on port 9004.CVE-2022-31199-lab/README.md:105-107
  3. Access the attacker container and run the test exploit script against the vulnerable server.CVE-2022-31199-lab/README.md:109-113
  4. Use the exploit tools to detect the vulnerability, fingerprint the service, or test exploitation.CVE-2022-31199-lab/exploit-tools/README.md:15-30
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's internal network. The vulnerable server only listens on the container's port 9004, which is mapped to the host but intended for lab access. The attacker container runs only provided exploit scripts. No evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the lab target.

CVE-2022-31199-lab/docker-compose.macos.yml:1-36CVE-2022-31199-lab/vulnerable-server.py:1-132CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-498
Review boundaries

What the analysis did not establish

  • The packet includes only the macOS Compose file; other deployment options (Windows, Linux) are referenced but not provided.
  • The exploit-tools directory contains only a README and test_exploit.py; the referenced exploit.py and other tools are not present.
  • The build.sh script references C# source files (VulnerableRemotingServer.cs, UAVRServer.cs) that are not included in the evidence, so the full .NET simulation cannot be assessed.
  • No actual exploitation payloads (e.g., ysoserial.net output) are included, so the exercise path is limited to detection and demonstration.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2022-31199-lab/docker-compose.yml

developerfred/CVE-2022-31199Created Vuln labCVE-2022-31199Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment simulating a vulnerable Netwrix Auditor .NET Remoting service (CVE-2022-31199) with an attacker machine for exploitation testing.

CVE-2022-31199-lab/docker-compose.yml:1-48CVE-2022-31199-lab/README.md:1-10

Lab assessment

Vulnerability lab

The README explicitly states the environment is a 'complete vulnerable environment for CVE-2022-31199' designed for security research and exploitation practice. The Docker Compose file defines a vulnerable server and an attacker machine, and the included scripts provide detection and exploitation tools.

CVE-2022-31199-lab/README.md:1-5CVE-2022-31199-lab/docker-compose.yml:1-48
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

netwrix-vulnerable

vulnerable target server

A service built from a Dockerfile that compiles and runs a .NET Remoting server (UAVRServer.exe) on port 9004, simulating the vulnerable Netwrix Auditor. It mounts local directories for logs and exploits.

CVE-2022-31199-lab/docker-compose.yml:5-22CVE-2022-31199-lab/Dockerfile:1-29

attacker

attacker machineexploitation client

A Kali Linux container with interactive shell access, mounting exploit tools and exploits directories. It depends on the netwrix-vulnerable service and is intended for running detection and exploitation scripts against the target.

CVE-2022-31199-lab/docker-compose.yml:25-38

test_exploit.py

vulnerability detection toolexploitation testing script

A Python script that connects to the target, sends .NET Remoting probes, fingerprints the service, and tests exploitation. It includes a full scan mode and demo exploitation mode.

CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-498

vulnerable-server.py

alternative vulnerable server simulator

A Python script that simulates a vulnerable .NET Remoting service, listening on port 9004 and responding to probes. It logs exploitation attempts to /tmp/exploitation_attempts.log.

CVE-2022-31199-lab/vulnerable-server.py:1-132

build.sh

build script for vulnerable application

A shell script that compiles the C# vulnerable server (UAVRServer.exe) using Mono or .NET Framework, creates configuration and startup scripts, and packages the application.

CVE-2022-31199-lab/vunerable-app/build.sh:1-311
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-31199

Supported by supplied evidence

The entire lab is explicitly named and documented for CVE-2022-31199. The README, Dockerfile labels, Compose environment variables, and exploit scripts all reference this CVE. The vulnerable server simulates the .NET Remoting insecure deserialization vulnerability described in the CVE.

CVE-2022-31199-lab/README.md:1-5CVE-2022-31199-lab/docker-compose.yml:11-12CVE-2022-31199-lab/Dockerfile:4-5CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.CVE-2022-31199-lab/README.md:67-69
  • The netwrix-vulnerable service must be built and running, exposing port 9004.CVE-2022-31199-lab/docker-compose.yml:5-22
  • The attacker container must be started and have network access to the vulnerable service.CVE-2022-31199-lab/docker-compose.yml:25-38

Evidence-described exercise path

  1. Start the lab environment using 'docker-compose up -d'.CVE-2022-31199-lab/README.md:100-102
  2. Verify the vulnerable server is running on port 9004 (e.g., 'nc -zv localhost 9004').CVE-2022-31199-lab/README.md:105-107
  3. Access the attacker container and run the detection script: 'python /root/tools/test_exploit.py --target netwrix-vulnerable --check'.CVE-2022-31199-lab/exploit-tools/README.md:15-17
  4. Optionally, run a full scan or exploitation test using the provided scripts.CVE-2022-31199-lab/exploit-tools/README.md:20-30
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target within the isolated Docker network. The attacker container only communicates with the netwrix-vulnerable service on port 9004. No host escape, external connections, persistence, credential theft, or destructive actions are observed. The bind mounts are for sharing exploit tools and logs, which is consistent with a vulnerability lab.

CVE-2022-31199-lab/docker-compose.yml:1-48CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-498
Review boundaries

What the analysis did not establish

  • The packet does not include the actual C# source files (VulnerableRemotingServer.cs, UAVRServer.cs) or the compiled binary UAVRServer.exe, so the exact vulnerability implementation cannot be verified.
  • The exploit-tools/exploit.py script referenced in the README is not included in the evidence files.
  • The Dockerfile uses a Windows base image, but the Compose file does not specify a platform; cross-platform compatibility is uncertain.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2022-31199-lab

developerfred/CVE-2022-31199Created Vuln labCVE-2022-31199Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A containerized lab environment for CVE-2022-31199, simulating a vulnerable Netwrix Auditor .NET Remoting service. It includes a Dockerfile to build a Mono-based server, a Python simulator, and exploit testing tools.

CVE-2022-31199-lab/README.md:1-3CVE-2022-31199-lab/Dockerfile.linux:1-32

Lab assessment

Vulnerability lab

The README explicitly states it is a 'complete vulnerable environment for CVE-2022-31199' designed for security research and education. The Dockerfile builds a server labeled with the CVE, and the included scripts are for testing and simulating the vulnerability.

CVE-2022-31199-lab/README.md:1-3CVE-2022-31199-lab/Dockerfile.linux:4-5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile.linux

builds the vulnerable Mono-based server container

Defines a Docker image based on mono:latest, installs mono-complete and netcat, copies a vulnerable application from 'vulnerable-app-linux/', compiles it into UAVRServer.exe, exposes port 9004, and runs the server.

CVE-2022-31199-lab/Dockerfile.linux:1-32

vulnerable-server.py

Python-based simulator of the vulnerable .NET Remoting service

A Python script that listens on port 9004, responds to .NET Remoting probes, logs exploitation attempts to /tmp/exploitation_attempts.log, and simulates deserialization errors. It is intended as a lightweight alternative to the full .NET server.

CVE-2022-31199-lab/vulnerable-server.py:1-132

test_exploit.py

exploit testing and vulnerability scanning tool

A Python script that connects to a target, sends .NET Remoting probes, checks for vulnerability indicators, performs time-based detection, fingerprints the service, and tests exploitation with a simple payload. It is designed for use against the lab's own target.

CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-498

build.sh

builds the vulnerable C# application

A shell script that checks for Mono or .NET compilers, compiles VulnerableRemotingServer.cs and UAVRServer.cs into UAVRServer.exe, creates configuration and startup scripts, and generates a README. It is part of the lab setup, not the runtime.

CVE-2022-31199-lab/vunerable-app/build.sh:1-311
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-31199

Supported by supplied evidence

The lab is explicitly named and documented for CVE-2022-31199. The Dockerfile labels the image with the CVE, the README describes the vulnerability as Netwrix Auditor .NET Remoting insecure deserialization, and the exploit script targets this CVE.

CVE-2022-31199-lab/README.md:1-3CVE-2022-31199-lab/Dockerfile.linux:4-5CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.CVE-2022-31199-lab/README.md:67-69
  • The vulnerable application source files (VulnerableRemotingServer.cs, UAVRServer.cs) must be present in the 'vulnerable-app-linux/' directory for the Docker build.CVE-2022-31199-lab/Dockerfile.linux:13-14
  • For actual exploitation (not just detection), external tools like ysoserial.net and ExploitRemotingService are required.CVE-2022-31199-lab/README.md:75-77

Evidence-described exercise path

  1. Build the Docker image using Dockerfile.linux.CVE-2022-31199-lab/README.md:107-108
  2. Run the container, exposing port 9004.CVE-2022-31199-lab/README.md:109
  3. Verify the server is running using netcat or telnet.CVE-2022-31199-lab/README.md:115-119
  4. Use the provided test_exploit.py script to check for vulnerability.CVE-2022-31199-lab/README.md:130-133
  5. Optionally, use external tools like ysoserial.net to generate and send a malicious payload for remote code execution.CVE-2022-31199-lab/README.md:145-150
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target. The Dockerfile builds a server that listens on port 9004, the Python simulator logs exploitation attempts locally, and the exploit script only connects to a user-specified target. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab exercise.

CVE-2022-31199-lab/Dockerfile.linux:1-32CVE-2022-31199-lab/vulnerable-server.py:1-132CVE-2022-31199-lab/exploit-tools/test_exploit.py:1-498
Review boundaries

What the analysis did not establish

  • The packet includes only the Dockerfile.linux and selected scripts; other Dockerfiles (Dockerfile, docker-compose files) and C# source files are listed in the inventory but not provided as evidence text, so their behavior cannot be assessed.
  • The build.sh script is truncated in the evidence, so its full content is unknown.
  • The lab relies on external tools (ysoserial.net, ExploitRemotingService) for full exploitation, which are not included in the packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3