CVE-2023-35182
📋 TL;DR
CVE-2023-35182 is a remote code execution vulnerability in SolarWinds Access Rights Manager that allows unauthenticated attackers to execute arbitrary code on the ARM server. This affects organizations running vulnerable versions of SolarWinds ARM, potentially compromising the entire server and connected systems.
💻 Affected Systems
- SolarWinds Access Rights Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the ARM server leading to domain takeover, credential theft, lateral movement across the network, and deployment of ransomware or other malware.
Likely Case
Attackers gain initial foothold on the network, install backdoors, steal credentials, and move laterally to other systems.
If Mitigated
Attack blocked at network perimeter or detected early, limiting impact to isolated security incident requiring investigation.
🎯 Exploit Status
Unauthenticated RCE vulnerabilities in enterprise software are frequently weaponized quickly. While no public PoC exists, threat actors likely have developed exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.2.1 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35182
Restart Required: Yes
Instructions:
1. Download SolarWinds ARM 2023.2.1 or later from the SolarWinds customer portal. 2. Backup current configuration and database. 3. Run the installer with administrative privileges. 4. Restart the ARM service or server as prompted.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to ARM server to only trusted management networks
Configure firewall rules to block all inbound traffic to ARM server except from authorized management IPs
Application Layer Filtering
allImplement WAF rules to block suspicious requests to ARM endpoints
Add WAF rules to block requests with suspicious patterns to /SolarWinds/ARM/* endpoints
🧯 If You Can't Patch
- Immediately isolate the ARM server from internet access and restrict internal network access to only necessary administrative systems
- Implement strict monitoring and alerting for suspicious activity on the ARM server, including process creation and network connections
🔍 How to Verify
Check if Vulnerable:
Check ARM version in SolarWinds ARM web interface under Help > About. If version is below 2023.2.1, system is vulnerable.Check Version:
In ARM web interface: Navigate to Help > About to view versionVerify Fix Applied:
Verify ARM version is 2023.2.1 or higher in Help > About. Test that ARM functionality works normally after update.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from ARM service account
- Suspicious PowerShell or command execution events from ARM server
- Failed authentication attempts followed by successful exploitation patterns
Network Indicators:
- Unusual outbound connections from ARM server to external IPs
- Suspicious HTTP requests to ARM web endpoints from unexpected sources
SIEM Query:
source="arm_server" AND (process_name="powershell.exe" OR process_name="cmd.exe") AND user="ARM_Service"🔗 References
- https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35182
- https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35182
