CVE-2021-35212
📋 TL;DR
CVE-2021-35212 is a blind Boolean SQL injection vulnerability in SolarWinds Orion Platform that allows authenticated users to escalate privileges and gain full read/write access to the Orion database, including sensitive certificates. This affects any organization running vulnerable versions of SolarWinds Orion products. Attackers could compromise the entire Orion infrastructure through this vulnerability.
💻 Affected Systems
- SolarWinds Orion Platform
📦 What is this software?
Orion Platform by Solarwinds
Orion Platform by Solarwinds
Orion Platform by Solarwinds
Orion Platform by Solarwinds
Orion Platform by Solarwinds
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Orion database leading to certificate theft, lateral movement across network, and persistent backdoor access to managed systems.
Likely Case
Privilege escalation to administrative access, data exfiltration from Orion database, and potential credential harvesting.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and monitoring are implemented.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. ZDI has published technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2020.2.6 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35212
Restart Required: Yes
Instructions:
1. Download Orion Platform 2020.2.6 or later from SolarWinds Customer Portal. 2. Backup current Orion installation. 3. Run the installer with administrative privileges. 4. Restart Orion services after installation completes.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Orion Platform to only trusted administrative networks and users.
Principle of Least Privilege
allReview and minimize user accounts with access to Orion Platform, removing unnecessary privileges.
🧯 If You Can't Patch
- Implement strict network access controls to limit Orion Platform access to essential personnel only.
- Enable detailed SQL query logging and monitor for unusual database access patterns.
🔍 How to Verify
Check if Vulnerable:
Check Orion Platform version in web interface under Settings > All Settings > Product Information.Check Version:
Not applicable - check via Orion web interface or Windows Services for Orion version.Verify Fix Applied:
Verify version is 2020.2.6 or later and test that SQL injection payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in Orion database logs
- Multiple failed login attempts followed by successful authentication
- Unexpected privilege escalation events
Network Indicators:
- Unusual database connection patterns to Orion SQL server
- HTTP requests containing SQL injection patterns to Orion web interface
SIEM Query:
source="orion_logs" AND ("sql injection" OR "privilege escalation" OR "unusual query")🔗 References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35212
- https://www.zerodayinitiative.com/advisories/ZDI-21-1243/
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35212
- https://www.zerodayinitiative.com/advisories/ZDI-21-1243/
