CVE-2023-35180
📋 TL;DR
CVE-2023-35180 is a remote code execution vulnerability in SolarWinds Access Rights Manager that allows authenticated users to execute arbitrary code by abusing the ARM API. This affects organizations using vulnerable versions of SolarWinds ARM. Attackers with valid credentials can exploit this to gain full control of affected systems.
💻 Affected Systems
- SolarWinds Access Rights Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary code, steal sensitive data, deploy ransomware, or pivot to other network systems.
Likely Case
Privilege escalation leading to unauthorized access to sensitive systems and data, potentially enabling lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and monitoring are in place, though risk remains for authenticated users.
🎯 Exploit Status
Exploitation requires authenticated access; complexity is low once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.2.1 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35180
Restart Required: Yes
Instructions:
1. Download SolarWinds ARM version 2023.2.1 or later from the SolarWinds customer portal. 2. Backup current configuration and data. 3. Run the installer to upgrade. 4. Restart the ARM service or server as prompted.
🔧 Temporary Workarounds
Restrict API Access
windowsLimit network access to the ARM API to trusted IP addresses only using firewall rules.
Example Windows firewall command: netsh advfirewall firewall add rule name="Block ARM API" dir=in action=block protocol=TCP localport=17778 remoteip=any
Enforce Strong Authentication
allImplement multi-factor authentication and strong password policies for ARM users to reduce credential compromise risk.
🧯 If You Can't Patch
- Isolate the ARM system in a segmented network with strict access controls.
- Monitor for unusual API activity and implement alerting for suspicious authentication attempts.
🔍 How to Verify
Check if Vulnerable:
Check the ARM version in the SolarWinds ARM web interface under Help > About. If version is below 2023.2.1, it is vulnerable.Check Version:
In ARM web UI: Navigate to Help > About to view version.Verify Fix Applied:
After patching, verify the version is 2023.2.1 or higher in the About section and test API functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual API requests in ARM logs, unexpected process executions, or authentication from suspicious IPs.
Network Indicators:
- Abnormal traffic to ARM API port (default 17778), especially from unauthorized sources.
SIEM Query:
Example: source="ARM_logs" AND (event="API_ABUSE" OR process="suspicious_executable")🔗 References
- https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35180
- https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35180
