CVE-2021-25276
📋 TL;DR
This vulnerability allows unprivileged Windows users with filesystem access to add FTP users by copying profile files to a world-readable/writable directory. Attackers can gain LocalSystem privileges to read or replace arbitrary files. Affects SolarWinds Serv-U FTP servers before version 15.2.2 Hotfix 1.
💻 Affected Systems
- SolarWinds Serv-U FTP Server
📦 What is this software?
Serv U by Solarwinds
Serv U by Solarwinds
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with LocalSystem privileges, allowing arbitrary file access, privilege escalation, and complete control of the affected server.
Likely Case
Unauthorized FTP user creation leading to data exfiltration, file manipulation, or lateral movement within the network.
If Mitigated
Limited impact if proper access controls restrict filesystem access to authorized administrators only.
🎯 Exploit Status
Exploitation requires local filesystem access but is straightforward once access is obtained. The vulnerability is well-documented with public technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.2.2 Hotfix 1 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-25276
Restart Required: Yes
Instructions:
1. Download SolarWinds Serv-U version 15.2.2 Hotfix 1 or later from the SolarWinds customer portal. 2. Run the installer as administrator. 3. Follow the upgrade wizard. 4. Restart the Serv-U service or reboot the server.
🔧 Temporary Workarounds
Restrict directory permissions
windowsModify NTFS permissions on the user profile directory to restrict access to authorized administrators only.
icacls "C:\Program Files\SolarWinds\Serv-U\Users" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F"
🧯 If You Can't Patch
- Implement strict access controls to prevent unprivileged users from accessing the Serv-U installation directory.
- Monitor for unauthorized file modifications in the Serv-U user profile directory and unexpected FTP user creations.
🔍 How to Verify
Check if Vulnerable:
Check Serv-U version via the management console or registry: HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Serv-U\Version. If version is below 15.2.2.100, the system is vulnerable.Check Version:
reg query "HKLM\SOFTWARE\SolarWinds\Serv-U" /v VersionVerify Fix Applied:
Confirm version is 15.2.2.100 or higher and verify directory permissions on the user profile folder are restricted to administrators and SYSTEM only.📡 Detection & Monitoring
Log Indicators:
- Unexpected FTP user creation events
- File modification events in Serv-U user profile directory
- Failed permission change attempts on Serv-U directories
Network Indicators:
- Unusual FTP connections from new or unexpected user accounts
- Suspicious file transfers via FTP
SIEM Query:
source="Serv-U" AND (event_type="user_created" OR file_path="*Serv-U\Users*")