Another Critical RCE Flaw Discovered in SolarWinds Orion Platform
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3109 +1 in the same advisory: …35856 | The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account. The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account. NVD description · AI analysis pending | 4.8 | <1% |
| — | ||
| CVE-2021-25274 +1 in the same advisory: …25275 | The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon processing of such messages, the service deserializes them in insecure manner, allowing remote arbitrary code execution as LocalSystem. NVD description · AI analysis pending | 9.8 group max | 36% | PoC |
| — |
Full article337 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 26, 2021
IT infrastructure management provider SolarWinds on Thursday released a new update to its Orion networking monitoring tool with fixes for four security vulnerabilities, counting two weaknesses that could be exploited by an authenticated attacker to achieve remote code execution (RCE).
Chief among them is a JSON deserialization flaw that allows an authenticated user to execute arbitrary code via the test alert actions feature available in the Orion Web Console, which lets users simulate network events (e.g., an unresponsive server) that can be configured to trigger an alert during setup. It has been rated critical in severity.
A second issue concerns a high-risk vulnerability that could be leveraged by an adversary to achieve RCE in the Orion Job Scheduler. "In order to exploit this, an attacker first needs to know the credentials of an unprivileged local account on the Orion Server," SolarWinds said in its release notes.
The advisory is light on technical specifics, but the two shortcomings are said to have been reported via Trend Micro's Zero Day Initiative.
Besides the aforementioned two flaws, the update squashes two other bugs, including a high-severity stored cross-site scripting (XSS) vulnerability in the "add custom tab" within customize view page (CVE-2020-35856) and a reverse tabnabbing and open redirect vulnerability in the custom menu item options page (CVE-2021-3109), both of which require an Orion administrator account for successful exploitation.
The new update also brings a number of security improvements, with fixes for preventing XSS attacks and enabling UAC protection for Orion database manager, among others.
The latest round of fixes arrives almost two months after the Texas-based company addressed two severe security vulnerabilities impacting Orion Platform (CVE-2021-25274 and CVE-2021-25275), which could have been exploited to achieve remote code execution with elevated privileges.
Orion users are recommended to update to the latest release, "Orion Platform 2020.2.5," to mitigate the risk associated with the security issues.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/03/solarwinds-orion-vulnerability.html