SolarWinds Serv-U Vulnerable to Directory Transversal Attack
Key Information
- Vendor
- Solarwinds
- Status
- Solarwinds Serv-u
- Vendor
- CVE Published:
- 6 June 2024
Badges
Summary
The vulnerability identified as CVE-2024-28995 affects SolarWinds Serv-U, allowing external unauthenticated attackers to read sensitive files on the host machine. The vulnerability is trivially exploitable and expected to be actively exploited in the near future. SolarWinds has since released a hotfix to address the issue. Despite not being targeted by ransomware groups at the time of the reports, the vulnerability poses a severe risk, as evidenced by the exploitation of similar vulnerabilities in file transfer servers in recent years. Rapid7 has recommended the immediate installation of the hotfix, emphasizing the urgency of addressing the vulnerability. Additionally, SolarWinds is facing legal challenges from the Securities and Exchange Commission (SEC), which adds further complications and implications to the situation.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-28995 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
SolarWinds Serv-U <= 15.4.2 HF 1 and previous versions
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
VMware, SolarWinds Vulnerabilities Exploited, and Cisco Warns of Critical ‘10.0’ Flaw
Cisco said the vulnerability was caused by an improper implementation of the password change process.
4 months ago
Cybersecurity teams advised to look out for critical Adobe, Cisco bugs
CISA added three bugs to the KEV catalog in all; Cisco gives flaw on Cisco Smart Software Manager On-Prem a 10 rating.
4 months ago
The Hacker News CVE-2024-34102CVE-2024-28995Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager
Cisco patches critical SSM On-Prem flaw. CISA adds three actively exploited vulnerabilities to KEV catalog. Federal agencies given August 7 deadline t
4 months ago
EPSS Score
95% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit exists.
Risk change from: 7.5 to: 8.6 - (HIGH)
Vulnerability started trending.
First article discovered by Help Net Security
Vulnerability published.
Vulnerability Reserved.