CVE-2024-23472: Directory Traversal in SolarWinds Access Rights Manager

The Directory Traversal vulnerability in SolarWinds ARM allows an authenticated user to bypass access controls and directly access files on the server's file system. This means an attacker could read sensitive configuration files, database credentials, or even application code. More concerningly, the vulnerability also permits file deletion, which could disrupt critical ARM functionality or even render the system unusable. The potential blast radius is significant, as compromised ARM instances often manage access to other critical systems and data. Successful exploitation could lead to complete system takeover and data exfiltration.

1. Reserved2024-01-17
2. Published2024-07-17
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-23472 is to upgrade SolarWinds Access Rights Manager to version 2024-3 or later, which contains the fix. If immediate upgrade is not possible, consider implementing temporary workarounds. Restrict access to the ARM web interface to only authorized personnel. Implement strict file access controls on the server hosting ARM, limiting the permissions of the ARM user account. Monitor ARM logs for suspicious activity, particularly attempts to access files outside of expected directories. After upgrading, confirm the vulnerability is resolved by attempting to access a file outside the intended directory via the ARM web interface; access should be denied.