Overview
A recently patched high-severity flaw in SolarWinds Serv-U file transfer software is being actively exploited by malicious actors. The vulnerability tracked as CVE-2024-28995, has a CVSS score of 8.6 and involves a directory traversal bug that can allow attackers to read sensitive files on the host machine.
Details of the Vulnerability
The vulnerability affects all versions of the software up to and including Serv-U 15.4.2 HF 1. SolarWinds addressed the issue in version Serv-U 15.4.2 HF 2 (15.4.2.157), released earlier this month. The affected products include:
- Serv-U FTP Server 15.4
- Serv-U Gateway 15.4
- Serv-U MFT Server 15.4
- Serv-U File Server 15.4
Discovery and Exploitation
Hussein Daher of Web Immunify discovered and reported the flaw. Following the public disclosure, additional technical details and a proof-of-concept (PoC) exploit have been made available. Rapid7, a cybersecurity firm, described the vulnerability as trivial to exploit, allowing external unauthenticated attackers to read any arbitrary file on disk, provided they know the path to the file and it’s not locked.
Potential Impact
According to Rapid7, high-severity information disclosure issues like CVE-2024-28995 can be used in “smash-and-grab” attacks, where adversaries quickly exfiltrate data from file transfer solutions to extort victims. File transfer products have been targeted by various adversaries, including ransomware groups, over the past few years.
Threat intelligence firm GreyNoise has observed opportunistic attacks weaponizing the flaw against its honeypot servers, with attempts to access sensitive files like /etc/passwd. These attempts have been recorded from various sources, including China.
Importance of Immediate Action
Given the history of previous flaws in Serv-U software being exploited by threat actors, it’s crucial for users to apply the updates as soon as possible to mitigate potential threats. The availability of PoCs significantly lowers the barrier to entry for malicious actors, making it imperative to act quickly.
Naomi Buckwalter, director of product security at Contrast Security, emphasized that successful exploitation of this vulnerability could be a stepping stone for attackers. By gaining access to sensitive information such as credentials and system files, attackers can launch further attacks, a technique known as “chaining,” potentially leading to a more widespread compromise.
Conclusion
To safeguard your systems, ensure you update to the latest version of Serv-U software immediately. Stay informed and vigilant to protect against potential threats.
For more updates and exclusive content, follow us on Facebook and LinkedIn.
Interested in more cybersecurity news and tips? Visit our blog for the latest insights.