SolarWinds Access Rights Manager में डायरेक्टरी ट्रैवर्सल और सूचना प्रकटीकरण भेद्यता

The impact of CVE-2024-23475 is severe due to its unauthenticated nature and the potential for arbitrary file deletion and information disclosure. An attacker could leverage this vulnerability to delete critical configuration files, database backups, or other sensitive data stored on the system. Successful exploitation could also lead to the exposure of credentials, personally identifiable information (PII), or proprietary business data. The ability to delete files could disrupt services and render the Access Rights Manager unusable, causing significant operational downtime. The lack of authentication required for exploitation dramatically increases the attack surface and potential for widespread compromise.

Organizations heavily reliant on SolarWinds Access Rights Manager for access control and privilege management are particularly at risk. Environments with limited network segmentation or inadequate access controls are also more vulnerable. Shared hosting environments where multiple customers share the same server infrastructure could experience widespread compromise if one customer's Access Rights Manager instance is exploited.

• windows / server:

Get-WinEvent -LogName Security -Filter "EventID = 4663 -MessageText '*\*'"; Get-Process -Name 'swarrm' | Select-Object -ExpandProperty Path

• windows / server:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*swarrm*'} | Select-Object -ExpandProperty Actions

• generic web:

curl -I 'http://<target>/../../../../etc/passwd' # Check for directory traversal response

1. 2024-07-17Disclosure

   disclosure

2. 2024-07-17Patch

   patch

1. आरक्षित2024-01-17
2. प्रकाशित2024-07-17
3. संशोधित2024-08-01
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-23475 is to upgrade SolarWinds Access Rights Manager to version 2024-3 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing temporary workarounds. Restrict network access to the Access Rights Manager server to only authorized personnel. Implement strict file permissions to limit the impact of potential file deletion. Monitor system logs for suspicious activity, particularly attempts to access or modify files outside of expected directories. Consider using a Web Application Firewall (WAF) to filter out malicious requests attempting to exploit directory traversal vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting a directory traversal request and verifying that access is denied.