Full Report
Read more about Huntress validating the SolarWinds N-central “Dumpster Diver” Vulnerability.
Analysis Summary
# Vulnerability: SolarWinds N-central "Dumpster Diver" Information Disclosure
## CVE Details
- **CVE ID:** CVE-2020-7984
- **CVSS Score:** 7.5 (High) - *Based on standard NVD rating for this CVE*
- **CWE:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
## Affected Systems
- **Products:** SolarWinds N-central (now N-able N-central)
- **Versions:** 12.1 SP1, 12.2 SP1, and potentially earlier versions including those considered "fully patched" at the time of discovery.
- **Configurations:** Systems with the "device auto-import" feature enabled and credentials stored within the Agent & Probe settings.
## Vulnerability Description
The vulnerability, dubbed "Dumpster Diver," allows an unauthenticated remote attacker to perform unauthorized actions on the N-central server. The flaw stems from an insecure implementation of the device auto-import and registration process. An attacker can register unauthorized agents and subsequently "dump" customer configuration files. These configuration files often contain sensitive information in cleartext, specifically Active Directory credentials (including Domain Admin passwords) stored within the N-central Agent & Probe settings.
## Exploitation
- **Status:** PoC available (Publicly released on Packet Storm and GitHub by researcher Justin Boltz/flipflopfpv).
- **Complexity:** Low (Scripted PoC allows novice users to exploit the flaw).
- **Attack Vector:** Network (Unauthenticated remote access).
## Impact
- **Confidentiality:** Total (Exposure of cleartext Domain Admin and Active Directory credentials).
- **Integrity:** High (Ability to register rogue agents and potentially manipulate monitoring configurations).
- **Availability:** Low (Primary impact is information theft rather than service disruption).
## Remediation
### Patches
SolarWinds released the following hotfixes which temporarily disable the N-central device auto-import feature to close the attack vector:
- **N-central 12.1 SP1 HF5**
- **N-central 12.2 SP1 HF2**
### Workarounds
- **Expunge Credentials:** SolarWinds provided instructions to manually clear/expunge stored credentials from the Customer levels of N-central to ensure that even if a "dump" occurs, no sensitive passwords are retrieved.
- **Disable Auto-Import:** Manually disable the agent auto-import feature if patches cannot be immediately applied.
## Detection
- **Indicators of Compromise:**
- Presence of unrecognized or unauthorized agents registered in the N-central dashboard.
- Unusual network traffic patterns originating from the N-central server to unexpected external IP addresses.
- **Detection Methods:** Review N-central audit logs for unauthorized configuration exports or agent registration events.
## References
- **Vendor Advisory:** hxxps[:]//success[.]solarwindsmsp[.]com/kb/solarwinds_n-central/How-to-Expunge-credentials-for-Customer-levels-of-SolarWinds-N-central
- **CVE Link:** hxxps[:]//cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2020-7984
- **Huntress Analysis:** hxxps[:]//www[.]huntress[.]com/blog/validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5
- **Original PoC (Packet Storm):** hxxps[:]//packetstormsecurity[.]com/files/156033/nCentralDumpsterDiver-master[.]zip