Platform
windows
Component
access-rights-manager
Fixed in
2023.2.5
CVE-2024-23471 describes a Remote Code Execution (RCE) vulnerability discovered in SolarWinds Access Rights Manager. Successful exploitation allows an authenticated user to abuse a SolarWinds service, leading to arbitrary code execution on the affected system. This vulnerability impacts versions of Access Rights Manager prior to 2023.2.4. A patch is available in version 2024-3.
The impact of CVE-2024-23471 is severe due to the RCE nature of the vulnerability. An attacker who can authenticate to the Access Rights Manager system can leverage this flaw to execute arbitrary code with the privileges of the affected service account. This could lead to complete system compromise, data exfiltration, and lateral movement within the network. The ability to execute code remotely bypasses typical security controls and significantly expands the attack surface. Similar RCE vulnerabilities in privileged access management tools have historically resulted in widespread data breaches and significant operational disruption.
CVE-2024-23471 was publicly disclosed on July 17, 2024. The vulnerability's criticality (CVSS 9.6) indicates a high probability of exploitation. As of this writing, there are no publicly available proof-of-concept exploits, but the ease of exploitation (requiring only authentication) suggests that it is likely to become a target for attackers. It is not currently listed on CISA KEV, but given its severity and potential impact, it may be added in the future.
Exploit Status
EPSS
1.59% (82% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-23471 is to upgrade SolarWinds Access Rights Manager to version 2024-3 or later. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing stricter authentication controls and limiting access to the Access Rights Manager service. Review and restrict user permissions to the minimum necessary for their roles. Monitor Access Rights Manager logs for suspicious activity, particularly authentication failures and unusual service behavior. While a WAF cannot directly prevent this RCE, it can help detect and block malicious payloads attempting to exploit the vulnerability. No specific Sigma or YARA rules are currently available, but monitoring for unusual process execution related to the Access Rights Manager service is recommended.
Update SolarWinds Access Rights Manager to version 2024-3 or later. The update addresses the remote code execution vulnerability. See the release notes for detailed instructions on how to update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-23471 is a critical RCE vulnerability in SolarWinds Access Rights Manager versions prior to 2023.2.4, allowing authenticated users to execute code remotely.
You are affected if you are running SolarWinds Access Rights Manager version 2023.2.4 or earlier. Check your version and upgrade immediately.
Upgrade to SolarWinds Access Rights Manager version 2024-3 or later to remediate the vulnerability. Implement stricter authentication controls as an interim measure.
While no public exploits are currently available, the vulnerability's criticality and ease of exploitation suggest it is likely to become a target for attackers.
Refer to the official SolarWinds security advisory on their website for detailed information and remediation steps: [https://www.solarwinds.com/securityadvisories](https://www.solarwinds.com/securityadvisories)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.