SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

The Directory Traversal vulnerability in SolarWinds ARM allows an authenticated user to bypass access controls and directly access files on the server's file system. This means an attacker could read sensitive configuration files, database credentials, or even application code. More concerningly, the vulnerability also permits file deletion, which could disrupt critical ARM functionality or even render the system unusable. The potential blast radius is significant, as compromised ARM instances often manage access to other critical systems and data. Successful exploitation could lead to complete system takeover and data exfiltration.

Organizations heavily reliant on SolarWinds Access Rights Manager for access control and privilege management are particularly at risk. This includes those with legacy ARM deployments or those who have not implemented strong access controls on the ARM web interface. Shared hosting environments where multiple customers share the same ARM instance are also at increased risk.

• solarwinds: Examine ARM logs for unusual file access patterns, particularly attempts to access files outside of the expected directory structure. Look for requests containing .. sequences in the file path.

Get-WinEvent -LogName Security -Filter "EventID=4663 -Message contains '..'">

1. 2024-07-17Disclosure

   disclosure

2. 2024-03Patch

   patch

1. Reserviert2024-01-17
2. Veröffentlicht2024-07-17
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-23472 is to upgrade SolarWinds Access Rights Manager to version 2024-3 or later, which contains the fix. If immediate upgrade is not possible, consider implementing temporary workarounds. Restrict access to the ARM web interface to only authorized personnel. Implement strict file access controls on the server hosting ARM, limiting the permissions of the ARM user account. Monitor ARM logs for suspicious activity, particularly attempts to access files outside of expected directories. After upgrading, confirm the vulnerability is resolved by attempting to access a file outside the intended directory via the ARM web interface; access should be denied.