CVE-2021-35218
📋 TL;DR
This vulnerability allows remote code execution through deserialization of untrusted data in the SolarWinds Orion Patch Manager Web Console. An attacker with network access to the web console can exploit this to execute arbitrary code on the server. Organizations running vulnerable versions of SolarWinds Patch Manager are affected.
💻 Affected Systems
- SolarWinds Orion Patch Manager
📦 What is this software?
Orion Platform by Solarwinds
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attacker to install malware, steal data, pivot to other systems, and maintain persistent access.
Likely Case
Server compromise leading to data theft, installation of backdoors, and potential lateral movement within the network.
If Mitigated
Attack blocked at network perimeter or detected before significant damage occurs.
🎯 Exploit Status
ZDI published technical details and proof-of-concept. Exploitation requires sending crafted requests to the vulnerable chart endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2020.2.6 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35218
Restart Required: Yes
Instructions:
1. Download Patch Manager 2020.2.6 or later from SolarWinds Customer Portal. 2. Run the installer on the Patch Manager server. 3. Restart the Patch Manager service and IIS. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Network Segmentation
windowsRestrict network access to the Patch Manager web console using firewall rules.
Windows Firewall: New-NetFirewallRule -DisplayName "Block PatchManager Console" -Direction Inbound -LocalPort 443 -Protocol TCP -Action Block
Disable Web Console
windowsTemporarily disable the web console component if not required.
Stop IIS service: Stop-Service W3SVC
Disable IIS: Set-Service W3SVC -StartupType Disabled
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Patch Manager web console
- Deploy web application firewall (WAF) rules to block deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check Patch Manager version in the web console admin interface or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Patch Manager\VersionCheck Version:
reg query "HKLM\SOFTWARE\SolarWinds\Patch Manager" /v VersionVerify Fix Applied:
Verify version is 2020.2.6 or higher and test the chart endpoint with safe payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /Orion/PatchManager/Chart.ashx endpoint
- IIS logs showing deserialization errors or unusual POST requests
Network Indicators:
- HTTP requests containing serialized .NET objects to chart endpoint
- Unusual outbound connections from Patch Manager server
SIEM Query:
source="iis" AND (uri="*Chart.ashx*" OR uri="*PatchManager*Chart*") AND (method="POST" OR status>=400)🔗 References
- https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35218
- https://www.zerodayinitiative.com/advisories/ZDI-21-1248/
- https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35218
- https://www.zerodayinitiative.com/advisories/ZDI-21-1248/
