Multiple vulnerabilities in SolarWinds Orion Platform

Published: 2021-10-26 | Updated: 2021-10-28

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2021-28674 CVE-2021-35212 CVE-2021-35213 CVE-2021-35215
CWE-ID	CWE-264 CWE-89 CWE-502
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #4 is available.
Vulnerable software	Orion Platform Server applications / Remote management servers, RDP, SSH
Vendor	SolarWinds

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU57641

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-28674

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to application does not properly impose security restrictions. A remote authenticated user with node management rights can delete nodes for another group.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Orion Platform: 2019.2 HF 1 - 2020.2.5

CPE2.3

External links

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-28674
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-5-Hotfix-1?language=en_US
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) SQL injection

EUVDB-ID: #VU57642

Risk: Medium

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-35212

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the DisableNOCView method. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Orion Platform: 2019.2 HF 1 - 2020.2.5

CPE2.3

External links

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35212
https://www.zerodayinitiative.com/advisories/ZDI-21-1243/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU57644

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-35213

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the User Setting of Orion Platform within the SaveUserSetting endpoint. A remote authenticated guest can gain administrative privileges within the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Orion Platform: 2020.2 HF 1 - 2020.2.5

CPE2.3

External links

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35213
https://www.zerodayinitiative.com/advisories/ZDI-21-1244/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Deserialization of Untrusted Data

EUVDB-ID: #VU57635

Risk: Medium

CVSSv4.0: 7.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2021-35215

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in ActionPluginBaseView. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Orion Platform: 2020.2 HF 1 - 2020.2.5

CPE2.3

External links

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35215
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
https://www.zerodayinitiative.com/advisories/ZDI-21-1245/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.