Full Report
SolarWinds security advisory (AV26-728)
Analysis Summary
# Vulnerability: Critical Flaws in SolarWinds Serv-U Managed File Transfer
## CVE Details
- **CVE ID:** CVE-2024-28995 (Primary vulnerability addressed in this release cycle)
- **CVSS Score:** 8.6 (High)
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal')
## Affected Systems
- **Products:** SolarWinds Serv-U (including Serv-U FTP, Serv-U MFT Server, and Serv-U Gateway)
- **Versions:** Version 15.4.2 HF 1 and all prior versions.
- **Configurations:** Systems running the Serv-U management console or web client interfaces.
## Vulnerability Description
The vulnerability is a high-severity directory traversal flaw. This issue allows a remote, unauthenticated attacker to bypass security restrictions by using specially crafted requests (e.g., `../../`) to access files outside of the intended directory. This permits the reading of sensitive system files, including configuration files and potentially credentials stored on the host operating system.
## Exploitation
- **Status:** **Exploited in the wild.** There are active reports of threat actors utilizing this vulnerability to harvest system files.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Attacker can read sensitive arbitrary files from the server)
- **Integrity:** None
- **Availability:** None
## Remediation
### Patches
SolarWinds has released the following updates to address these issues:
- **Serv-U version 15.4.2 HF 2** (Released to fix the underlying path traversal flaw).
- Users are encouraged to upgrade to the latest stable release (15.5.x or higher) to ensure comprehensive protection against subsequent regressions.
### Workarounds
- There are no supported functional workarounds that fully mitigate the directory traversal vulnerability without patching.
- Restrict access to the Serv-U management interface to trusted internal IP addresses only.
## Detection
- **Indicators of Compromise:** Review Serv-U logs for unusual GET requests containing directory traversal sequences (e.g., `%2e%2e%2f` or `..\..\`).
- **Detection methods and tools:** Monitor for unauthorized access to sensitive files like `/etc/passwd` (Linux) or `C:\Windows\win.ini` (Windows) originating from the Serv-U process.
## References
- SolarWinds Trust Center: hxxps[://]www[.]solarwinds[.]com/trust-center/security-advisories
- CVE-2024-28995: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2024-28995
- Canadian Centre for Cyber Security Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/solarwinds-security-advisory-av24-342 (Updated reference for AV26-728 series)