SolarWinds Serv-U 目录遍历远程代码执行漏洞

该漏洞的潜在影响非常严重。攻击者可以利用此漏洞在受影响的系统上执行任意代码，从而窃取敏感数据、安装恶意软件或完全控制系统。由于需要高权限才能利用此漏洞，因此攻击者可能需要先获得对系统的访问权限。然而，一旦获得访问权限，攻击者就可以利用此漏洞来执行各种恶意活动。此漏洞类似于其他目录遍历漏洞，可能导致攻击者访问系统上的敏感文件和目录。

Organizations that rely on SolarWinds Serv-U for file transfer and have not upgraded to version 15.4.2 are at risk. This includes businesses of all sizes, particularly those with legacy Serv-U deployments or those that have not implemented robust account management practices. Shared hosting environments where Serv-U is installed are also at increased risk due to the potential for cross-tenant exploitation.

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -eq "servu"}

• windows / supply-chain:

Get-WinEvent -LogName Security -Filter "EventID=4625" -MaxEvents 10 | Select-Object -Property TimeCreated, ProcessName, CommandLine

• windows / supply-chain: Check Autoruns for suspicious entries related to Serv-U or its installation directory. • windows / supply-chain: Monitor Windows Defender for alerts related to file access attempts outside of the Serv-U installation directory.

1. 2024-04-17Disclosure

   disclosure

1. 已保留2024-03-01
2. 发布日期2024-04-17
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

缓解此漏洞的首要措施是立即升级到 SolarWinds Serv-U 15.4.2 或更高版本。如果无法立即升级，可以考虑实施一些临时缓解措施。例如，可以限制对 Serv-U 服务的访问，只允许授权用户访问。还可以配置防火墙规则，阻止来自不受信任来源的流量访问 Serv-U 服务。此外，定期审查 Serv-U 服务的配置，确保其安全设置正确。升级后，请验证新版本是否已成功安装并配置，确认漏洞已修复。