CVE-2024-45717
📋 TL;DR
This cross-site scripting (XSS) vulnerability in SolarWinds Platform allows authenticated attackers to inject malicious scripts into the search and node information interface. When exploited, it can lead to session hijacking, data theft, or unauthorized actions within the authenticated user's context. Only authenticated SolarWinds Platform users are affected.
💻 Affected Systems
- SolarWinds Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator credentials, pivot to other systems, deploy ransomware, or exfiltrate sensitive network monitoring data.
Likely Case
Attackers would use this to hijack authenticated sessions, steal cookies, or perform actions as the victim user within SolarWinds.
If Mitigated
With proper input validation and output encoding, the attack would fail to execute malicious scripts.
🎯 Exploit Status
Requires authenticated access and social engineering to trick users into interacting with malicious content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.4.1 or later
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45717
Restart Required: No
Instructions:
1. Download SolarWinds Platform 2024.4.1 or later from the SolarWinds customer portal. 2. Follow SolarWinds upgrade documentation for your deployment. 3. Verify the update completes successfully.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation and output encoding for search and node information fields.
🧯 If You Can't Patch
- Restrict access to SolarWinds Platform to only necessary users with least privilege principles.
- Implement web application firewall (WAF) rules to block XSS patterns in search and node parameters.
🔍 How to Verify
Check if Vulnerable:
Check SolarWinds Platform version in the web interface under Help > About.Check Version:
Not applicable - check via web interface or SolarWinds Orion Installer.Verify Fix Applied:
Confirm version is 2024.4.1 or later and test search functionality with basic XSS payloads like <script>alert('test')</script>.📡 Detection & Monitoring
Log Indicators:
- Unusual search queries containing script tags or JavaScript in SolarWinds logs
- Multiple failed login attempts followed by successful authentication and suspicious searches
Network Indicators:
- HTTP requests to SolarWinds with encoded script payloads in query parameters
SIEM Query:
source="solarwinds" AND (query="*<script>*" OR query="*javascript:*" OR query="*onerror=*" OR query="*onload=*")