CVE-2022-35805: Microsoft Dynamics 365 RCE Vulnerability

CVE-2022-35805 Overview

CVE-2022-35805 is a Remote Code Execution (RCE) vulnerability affecting Microsoft Dynamics CRM on-premises deployments. This vulnerability allows an authenticated attacker with low privileges to execute arbitrary code on the target system through network-based attacks. The vulnerability requires no user interaction, making it particularly dangerous in enterprise environments where Microsoft Dynamics 365 is deployed for customer relationship management operations.

Critical Impact

Authenticated attackers can achieve complete system compromise through remote code execution, potentially gaining full control over Microsoft Dynamics CRM on-premises servers with high impact to confidentiality, integrity, and availability.

Affected Products

• Microsoft Dynamics 365 version 9.0 (on-premises)
• Microsoft Dynamics 365 version 9.1 (on-premises)

Discovery Timeline

• September 13, 2022 - CVE-2022-35805 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-35805

Vulnerability Analysis

This Remote Code Execution vulnerability in Microsoft Dynamics CRM on-premises allows authenticated attackers to execute arbitrary code on affected systems. The vulnerability can be exploited over the network without requiring any user interaction, though attackers must possess valid authentication credentials with low-level privileges to initiate an attack.

The vulnerability affects the on-premises deployment model of Microsoft Dynamics 365, specifically versions 9.0 and 9.1. Organizations running cloud-hosted versions of Dynamics 365 are not affected by this particular vulnerability. The nature of the flaw allows attackers who have successfully authenticated to the system to escalate their access and execute code in the context of the application, potentially leading to complete server compromise.

Root Cause

The specific technical root cause has not been publicly disclosed by Microsoft (NVD-CWE-noinfo). However, based on the vulnerability characteristics—network-accessible, requiring authentication, and enabling remote code execution—the flaw likely resides in improper input validation or insecure deserialization within the Dynamics CRM application layer that processes authenticated user requests.

Attack Vector

The attack vector for CVE-2022-35805 is network-based, requiring the attacker to have authenticated access to the Microsoft Dynamics CRM on-premises environment. The attack flow typically follows this pattern:

1. Attacker obtains valid low-privileged credentials for the Dynamics CRM system
2. Attacker authenticates to the on-premises Dynamics 365 instance over the network
3. Attacker crafts and sends malicious requests that exploit the vulnerability
4. The vulnerable component processes the malicious input and executes attacker-controlled code
5. Attacker gains code execution context on the target server

This vulnerability does not require any user interaction and can be exploited remotely, making automated exploitation feasible once valid credentials are obtained.

Detection Methods for CVE-2022-35805

Indicators of Compromise

• Unusual process spawning from Microsoft Dynamics CRM application pools or services
• Unexpected network connections originating from Dynamics CRM servers to external destinations
• Anomalous authentication patterns followed by suspicious activity on Dynamics 365 servers
• Presence of unexpected files or scripts in Dynamics CRM installation directories

Detection Strategies

• Monitor IIS logs and Dynamics CRM application logs for unusual request patterns from authenticated users
• Implement behavioral analysis for Dynamics CRM server processes to detect code execution anomalies
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities
• Audit authentication logs for credential abuse patterns targeting Dynamics CRM systems

Monitoring Recommendations

• Enable comprehensive logging for Microsoft Dynamics 365 on-premises installations
• Configure security information and event management (SIEM) alerts for suspicious Dynamics CRM activity
• Monitor for lateral movement attempts originating from compromised Dynamics CRM servers
• Regularly review access logs for low-privileged accounts exhibiting abnormal behavior

How to Mitigate CVE-2022-35805

Immediate Actions Required

• Apply the latest security updates from Microsoft for Dynamics 365 on-premises versions 9.0 and 9.1
• Review and restrict network access to Dynamics CRM servers to authorized networks only
• Audit user accounts and remove unnecessary low-privileged accounts from the system
• Implement network segmentation to limit the blast radius of potential compromises

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should consult the Microsoft Security Advisory for detailed patch information and download links. It is critical to apply these updates to all affected Microsoft Dynamics 365 on-premises deployments running versions 9.0 or 9.1.

Workarounds

• Restrict network access to Dynamics CRM servers using firewall rules and network segmentation
• Implement strict authentication policies and multi-factor authentication for all Dynamics CRM users
• Consider temporarily disabling non-essential features or services until patches can be applied
• Deploy web application firewall (WAF) rules to filter potentially malicious requests

# Example: Restrict IIS access to trusted networks via Windows Firewall
netsh advfirewall firewall add rule name="Restrict Dynamics CRM Access" ^
    dir=in action=allow protocol=tcp localport=443 ^
    remoteip=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16