CVE-2018-19999
📋 TL;DR
This vulnerability allows local users on a Windows system running SolarWinds Serv-U FTP Server to bypass authentication and execute arbitrary code with SYSTEM privileges. Attackers need local access and an active administrator management console session. This affects organizations using vulnerable versions of Serv-U FTP Server.
💻 Affected Systems
- SolarWinds Serv-U FTP Server
📦 What is this software?
Serv U Ftp Server by Solarwinds
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of persistent malware, data theft, and lateral movement across the network.
Likely Case
Privilege escalation from a standard user account to SYSTEM, enabling unauthorized access to sensitive files and system configuration.
If Mitigated
Limited impact due to restricted local access controls and no active administrator sessions.
🎯 Exploit Status
Exploitation requires local access and specific conditions, but the vulnerability is well-documented with proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.1.6.26 and later
Vendor Advisory: https://www.solarwinds.com/securityadvisory
Restart Required: Yes
Instructions:
1. Download the latest version from SolarWinds website. 2. Backup current configuration. 3. Run the installer to upgrade. 4. Restart the Serv-U service.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit local login access to Serv-U hosts to trusted administrators only.
Session Management
windowsEnsure administrator management console sessions are closed when not in active use.
🧯 If You Can't Patch
- Implement strict local access controls and monitor for unauthorized local logins.
- Use application whitelisting to prevent execution of unauthorized binaries.
🔍 How to Verify
Check if Vulnerable:
Check Serv-U version in the management console or via 'Serv-U.exe --version' command.Check Version:
Serv-U.exe --versionVerify Fix Applied:
Verify version is 15.1.6.26 or higher and test authentication controls.📡 Detection & Monitoring
Log Indicators:
- Unusual local authentication attempts
- Unexpected process execution with SYSTEM privileges
Network Indicators:
- Local connections to Serv-U management interface from unauthorized accounts
SIEM Query:
EventID=4688 AND ProcessName='Serv-U.exe' AND IntegrityLevel='System' AND ParentProcess NOT LIKE '%Serv-U%'