SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code Execution

Microsoft researchers discovered a remote code execution flaw in SolarWinds Serv-U, an out-of-bounds write (CWE-787) described as a "Remote Memory Escape" in the Windows-based Serv-U products. A remote, unauthenticated attacker can trigger the flaw over the network against servers running a version before 15.2.3 HF2 and gain privileged access to the machine hosting Serv-U, with a maximum CVSS 10.0 score reflecting no required privileges, no user interaction, and impact beyond the application's security scope. Both Serv-U Managed File Transfer and Serv-U Secure FTP for Windows are affected. The vulnerability has been exploited in the wild: Microsoft attributed July 2021 attacks exploiting the Serv-U zero-day to Chinese threat actors, later warned of an uptick in exploitation attempts, and the flaw was added to CISA KEV on 2021-11-03 with known ransomware use.

Do: Upgrade Serv-U to 15.2.3 Hotfix 2 (HF2) or later per SolarWinds' instructions immediately, as the flaw is in CISA KEV with known exploitation including ransomware use. Audit Serv-U servers and their logs for signs of exploitation or compromise, and restrict internet exposure of Serv-U/FTP and SSH ports to trusted parties.

CVE-2021-35247 is an improper input validation flaw (CWE-20) in the SolarWinds Serv-U web login screen's LDAP authentication path, where submitted characters are not sufficiently sanitized before being passed to the LDAP server. It is triggered remotely over the network with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), by sending crafted, non-sanitized characters through the login-to-LDAP flow; SolarWinds notes that LDAP servers ignored the improper characters and no downstream effect was detected, and the 5.3 (medium) CVSS score reflects a low integrity impact with no confidentiality or availability impact. An attacker gains the ability to feed unsanitized input into the LDAP authentication process; no confirmed code execution or full compromise is documented for this specific bug, but it is nevertheless on CISA's Known Exploited Vulnerabilities catalog. Affected organizations are those running SolarWinds Serv-U whose web login screen uses LDAP authentication. Exploitation is confirmed in the wild: CISA added the bug to the KEV catalog on 2022-01-21, Microsoft warned that threat actors attempted to exploit the Serv-U bug in real-world attacks, and reporting on this flaw surfaced alongside the Log4j (Log4Shell) attack wave targeting SolarWinds products.

Do: Schedule an upgrade to the latest SolarWinds Serv-U release, which adds the required input validation and sanitization to the LDAP login path; this is the CISA KEV required action, so KEV deadlines apply. Until patched, restrict access to the Serv-U web login from untrusted networks and review LDAP/authentication logs for suspicious or malformed login input. While updating, also confirm Serv-U is patched for the related critical Serv-U 15.5 root code execution flaws and any Log4j exposure covered in the same reporting cycle.

CVE-2024-28995 is a directory traversal flaw (CWE-22) in SolarWinds Serv-U, the vendor's managed file transfer/FTP server. Per the CVSS vector, it is reachable over the network with low attack complexity and requires no privileges or user interaction, meaning an unauthenticated remote attacker can trigger it. By sending traversal sequences that escape the intended directory, the attacker gains the ability to read sensitive files on the host machine (high confidentiality impact, with no integrity or availability impact). Any organization running SolarWinds Serv-U is potentially affected, particularly instances exposed to the internet. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-17, threat actors were reported exploiting it in the wild, and EPSS puts the 30-day exploitation probability at 99.6%, although no public proof-of-concept is known.

Do: Apply SolarWinds' patch or hotfix for Serv-U per the vendor's July 2024 PSIRT advisory, prioritizing internet-facing instances; if mitigations cannot be applied, CISA's required action is to follow vendor instructions or discontinue use of the product. In the meantime, restrict Serv-U exposure to trusted networks and review FTP/web server access logs for traversal-style requests that could indicate file reads or exfiltration.

An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.