CVE-2024-23475
📋 TL;DR
CVE-2024-23475 is a critical directory traversal vulnerability in SolarWinds Access Rights Manager that allows unauthenticated attackers to delete arbitrary files and access sensitive information. This affects all organizations running vulnerable versions of SolarWinds ARM. The vulnerability stems from improper path validation (CWE-22).
💻 Affected Systems
- SolarWinds Access Rights Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, exposure of credentials and configuration data, and potential ransomware deployment.
Likely Case
Sensitive information disclosure including credentials, configuration files, and database information, leading to further system compromise.
If Mitigated
Limited impact with proper network segmentation and access controls, but still poses significant risk if exposed.
🎯 Exploit Status
Directory traversal vulnerabilities are typically easy to exploit with simple path manipulation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.3
Vendor Advisory: https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm
Restart Required: Yes
Instructions:
1. Download SolarWinds ARM 2024.3 from the SolarWinds customer portal. 2. Backup current configuration and database. 3. Run the installer with administrative privileges. 4. Restart the ARM service and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to SolarWinds ARM to only trusted administrative networks
Web Application Firewall
allImplement WAF rules to block directory traversal patterns
🧯 If You Can't Patch
- Immediately isolate the SolarWinds ARM server from all untrusted networks
- Implement strict network access controls and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check SolarWinds ARM version in the web interface under Help > About. If version is below 2024.3, the system is vulnerable.Check Version:
Not applicable - check via web interface or Windows Services for version informationVerify Fix Applied:
Verify version is 2024.3 or higher in Help > About, then test that directory traversal attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Directory traversal strings in web logs (../, ..\, %2e%2e/)
- Unauthenticated access to sensitive endpoints
Network Indicators:
- Unusual outbound connections from ARM server
- File deletion requests from unauthenticated sources
SIEM Query:
source="solarwinds_arm" AND (uri="*../*" OR uri="*..\\*" OR status=200 AND method=DELETE AND auth="none")