CVE-2024-29004
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in SolarWinds Platform allows a high-privileged user to inject malicious scripts into the web console. When other users interact with the compromised interface, the scripts execute in their browser context. The vulnerability requires both high privileges and user interaction to exploit.
💻 Affected Systems
- SolarWinds Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
A compromised high-privileged account could inject scripts that steal session cookies, perform actions as other users, or deploy malware to client systems.
Likely Case
Privilege escalation or data theft from users who interact with malicious content injected by a rogue administrator.
If Mitigated
Limited impact due to requirement for high privileges and user interaction; proper access controls and monitoring reduce risk.
🎯 Exploit Status
Exploitation requires high-privileged credentials and user interaction, making automated attacks difficult.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.2 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29004
Restart Required: Yes
Instructions:
1. Download SolarWinds Platform 2024.2 or later from SolarWinds customer portal. 2. Run the installer with administrative privileges. 3. Follow the upgrade wizard. 4. Restart the SolarWinds services after installation completes.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation and output encoding for web console fields.
🧯 If You Can't Patch
- Restrict high-privileged accounts to trusted personnel only and implement strict access controls.
- Monitor user activity logs for suspicious behavior from high-privileged accounts.
🔍 How to Verify
Check if Vulnerable:
Check SolarWinds Platform version in web console under Help > About.Check Version:
Not applicable - check via web interface.Verify Fix Applied:
Verify version is 2024.2 or later and test XSS payloads in web console fields.📡 Detection & Monitoring
Log Indicators:
- Unusual activity from high-privileged accounts
- JavaScript payloads in web console logs
Network Indicators:
- Unexpected outbound connections from SolarWinds server after user interactions
SIEM Query:
source="solarwinds" AND (event_type="admin_action" OR message="script")🔗 References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29004
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29004
