SolarWinds Security Event Manager - Unauthenticated RCE

highseverity

8.8CVSS score

92.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.

Impact

Unauthenticated attackers on the adjacent network can execute arbitrary code remotely on the SolarWinds Security Event Manager, leading to complete system compromise and potential access to all security event data.

Fix

Upgrade to SolarWinds Security Event Manager version 2023.4.1 or later.

How to confirm it

Send: GET /webui/
Positive when: contains "SolarWinds Security Event Manager"
Send: POST /services/messagebroker/streamingamf
Positive when: status_code == 200 and contains(content_type, "application/x-amf") and contains(body, "AMF version")

Run it with nuclei: nuclei -id CVE-2024-0692 -u <target>

The full check

id: CVE-2024-0692

info:
  name: SolarWinds Security Event Manager - Unauthenticated RCE
  author: DhiyaneshDK
  severity: high
  description: |
    The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.
  impact: |
    Unauthenticated attackers on the adjacent network can execute arbitrary code remotely on the SolarWinds Security Event Manager, leading to complete system compromise and potential access to all security event data.
  remediation: |
    Upgrade to SolarWinds Security Event Manager version 2023.4.1 or later.
  reference:
    - https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2023-4-1_release_notes.htm
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2024-0692
    cwe-id: CWE-502
    epss-score: 0.92245
    epss-percentile: 0.99824
    cpe: cpe:2.3:a:solarwinds:security_event_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: solarwinds
    product: security_event_manager
    fofa-query: title="SolarWinds Security Event Manager"
  tags: cve,cve2024,solarwinds,event-manager,cisa,vkev,vuln

http:
  - raw:
      - |
        GET /webui/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "SolarWinds Security Event Manager"
        internal: true

  - raw:
      - |
        POST /services/messagebroker/streamingamf HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-amf

        abc

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/x-amf")'
          - 'contains(body, "AMF version")'
        condition: and

References

https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2023-4-1_release_notes.htm

Use this check only on systems you are authorised to test. Where the data comes from