CVE-2021-35220
📋 TL;DR
CVE-2021-35220 is a command injection vulnerability in SolarWinds Orion Platform's EmailWebPage API that allows attackers to execute arbitrary commands on affected systems. This can lead to remote code execution (RCE) from the Alerts Settings page. Organizations running vulnerable versions of SolarWinds Orion Platform are affected.
💻 Affected Systems
- SolarWinds Orion Platform
📦 What is this software?
Orion Platform by Solarwinds
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the SolarWinds server, enabling lateral movement, data exfiltration, and persistent backdoor installation.
Likely Case
Unauthorized command execution leading to system reconnaissance, credential harvesting, and deployment of additional malware or ransomware.
If Mitigated
Limited impact with proper network segmentation and access controls preventing lateral movement and data exfiltration.
🎯 Exploit Status
Exploitation requires authenticated access to the Alerts Settings page. Multiple proof-of-concept exploits are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Orion Platform 2020.2.6 Hotfix 1 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220
Restart Required: Yes
Instructions:
1. Download Orion Platform 2020.2.6 Hotfix 1 or later from SolarWinds Customer Portal. 2. Backup current configuration and database. 3. Run the installer with administrative privileges. 4. Restart Orion services after installation completes.
🔧 Temporary Workarounds
Disable EmailWebPage API
windowsTemporarily disable the vulnerable EmailWebPage API functionality until patching can be completed.
Navigate to Settings > All Settings > Alerting > Email/Web Page Settings and disable web page alert actions
Restrict Access to Alerts Settings
windowsLimit access to the Alerts Settings page to only necessary administrative users.
Configure Orion user permissions to restrict 'Alert Settings' access to minimal required personnel
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SolarWinds Orion servers from critical systems
- Enable detailed logging and monitoring for suspicious command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check Orion Platform version in Help > About. If version is 2020.2.5 or earlier, the system is vulnerable.Check Version:
In Orion Web Console, navigate to Help > About to view current versionVerify Fix Applied:
Verify installation of Orion Platform 2020.2.6 Hotfix 1 or later in Help > About and test EmailWebPage functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in Windows Event Logs
- Suspicious PowerShell or cmd.exe activity from Orion processes
- Unexpected network connections from Orion server
Network Indicators:
- Outbound connections from Orion server to unexpected destinations
- Command and control traffic patterns
SIEM Query:
source="windows" process_name="cmd.exe" OR process_name="powershell.exe" parent_process="Orion*" | stats count by src_ip, dest_ip, command_line🔗 References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-EmailWebPage-Command-Injection-RCE-CVE-2021-35220?language=en_US
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-EmailWebPage-Command-Injection-RCE-CVE-2021-35220?language=en_US
- https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220
