Researchers have discovered three new vulnerabilities embedded in SolarWinds products, including two in the Orion Platform that was at the heart of one of the largest-scale hacks in modern history.
They concern two flaws in the Orion Platform, which hackers previously exploited in last year’s infamous supply chain attack, as well as one bug in Serv-U FTP for Windows, a file transfer protocol (FTP) server and client software.
Although these flaws haven’t been exploited in the recent SolarWinds attacks, nor in any attacks in the wild so far, researchers with Trustwave SpiderLabs have deemed them to be severe bugs that demand urgent patching.
“The patches for the three severe vulnerabilities that Trustwave discovered were issued in January,” said senior security research manager with Trustwave SpiderLabs, Karl Sigler.
“This latest development re-emphasizes the need for thorough security testing for complex software platforms and shows what could have happened if Trustwave had not discovered the three identified severe vulnerabilities before the bad actors did.”
The first Orion vulnerability, tracked as CVE-2021-25275, can be exploited by hackers to either steal information from a corporate network or add admin-level users to be used within the security platform.
The flaw centres on the insecure manner by which credentials are stored - and could allow any local users to take complete control over the SolarWinds Orion database, regardless of privilege level.
The second flaw, tagged CVE-2021-25274, centres on the improper use of Microsoft Messaging Queue (MSQ) and is considered the most severe.
This can allow remote unprivileged users to execute arbitrary code as if they had the highest privileges.
Finally, CVE-2021-25276 is a vulnerability in Serv-U FTP for Windows that can allow any user, regardless of privilege, to create a file that can define a new Serv-U FTP admin account with access to the C:\ drive.
Successful exploitation could lead to the attacker using the newly-created account to log in through FTP and read or replace any file on the C:\ drive.
SolarWinds has issued fixes for these vulnerabilities with ‘Orion Platform 2020.2.4’ and ‘ServU-FTP 15.2.2 Hotfix 1 Patch’. Trustwave has purposely excluded proof of concept (PoC) details from their blog post to give SolarWinds users longer to patch.
While there’s currently no evidence these flaws have been exploited, their disclosure is certain to raise alarm bells among SolarWinds customers who are still reeling from the devastating effects of the 2020 hack.
In what was considered one of the scariest horror stories of last year, it was revealed in December that hackers had infiltrated a litany of organisations by exploiting flaws in the SolarWinds Orion Platform.
An ongoing investigation has since found that hackers may have had access to the firm’s internal systems since September 2019, well over a year before SolarWinds confirmed it had fallen victim to the attack.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Billions of IoT devices will need to be secured in the next four years – zero trust could be the key to successNews Researchers have warned more than 28 billion IoT devices will need to be secured by 2028 as attacks on connected devices surge.
-
Cisco claims new smart switches provide next-level perimeter defenseNews Cisco’s ‘security everywhere’ mantra has just taken on new meaning with the launch of a series of smart network switches.
-
Five Eyes cyber agencies issue guidance on edge device vulnerabilitiesNews Cybersecurity agencies including the NCSC and CISA have issued fresh guidance on edge device security.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
