CVE-2018-16791
📋 TL;DR
CVE-2018-16791 allows attackers to read and modify the configuration file of SolarWinds SFTP/SCP Server, exposing stored passwords in plaintext or weak encryption. This enables credential theft and server backdooring. Organizations using SolarWinds SFTP/SCP Server through version 2018-09-10 are affected.
💻 Affected Systems
- SolarWinds SFTP/SCP Server
📦 What is this software?
Sftp\/scp Server by Solarwinds
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with administrative access, credential theft for all configured accounts, and persistent backdoor installation allowing ongoing unauthorized access.
Likely Case
Unauthorized access to sensitive files, credential harvesting for SFTP/SCP users, and potential lateral movement within the network.
If Mitigated
Limited to local file system access if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Exploitation requires local or remote file system access to read/write the configuration file. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2018-09-10
Vendor Advisory: https://www.solarwinds.com/securityadvisory
Restart Required: Yes
Instructions:
1. Upgrade SolarWinds SFTP/SCP Server to version after 2018-09-10. 2. Restart the service. 3. Verify configuration file permissions are secure.
🔧 Temporary Workarounds
Secure Configuration File Permissions
linuxRestrict read/write access to the configuration file to authorized users only.
chmod 600 /path/to/sftpserver.conf
chown root:root /path/to/sftpserver.conf
Windows ACL Restriction
windowsSet strict NTFS permissions on the configuration file.
icacls "C:\Program Files\SolarWinds\SFTP Server\config.xml" /inheritance:r /grant:r "Administrators:F" /grant:r "SYSTEM:F"
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the SFTP/SCP server from untrusted networks.
- Monitor file system access to the configuration file and alert on unauthorized modifications.
🔍 How to Verify
Check if Vulnerable:
Check if configuration file (e.g., sftpserver.conf or config.xml) has world-readable permissions and contains plaintext or weakly encrypted passwords.Check Version:
sftpserver --version or check SolarWinds management interface for version infoVerify Fix Applied:
Verify configuration file permissions are restricted (e.g., 600 on Linux, limited ACLs on Windows) and passwords are no longer stored insecurely.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to configuration file
- Unexpected modifications to SFTP/SCP server configuration
Network Indicators:
- Unusual SFTP/SCP connections from unexpected IP addresses
- Anomalous data exfiltration patterns
SIEM Query:
source="sftpserver.log" AND (event="config_file_access" OR event="password_reset")