Newforma Info Exchange Unauthenticated Deserialization Vulnerability Allowing Arbitrary Code Execution

A vulnerability in Newforma Info Exchange (NIX) allows remote, unauthenticated attackers to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. This issue arises from the acceptance of serialized .NET data via the '/remoteweb/remote.rem' endpoint. The vulnerability is present in Newforma Project Center Server (NPCS) environments, where a compromised NIX system can be used to attack an associated NPCS system.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the 'NT AUTHORITY\NetworkService' account.

Remediation

To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module.