SB2023091945 - Privilege escalation in SolarWinds Orion Platform

Description

This security bulletin contains information about 2 vulnerabilities.

1) Exposed dangerous method or function (CVE-ID: CVE-2023-23840)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists within the UpdateAction method in the SolarWinds Web Console. A remote authenticated administrator can execute arbitrary commands with NETWORK SERVICE privileges.

2) Exposed dangerous method or function (CVE-ID: CVE-2023-23845)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists within the UpdateActionsProperties method in the SolarWinds Web Console. A remote authenticated administrator can execute arbitrary commands with NETWORK SERVICE privileges.

Remediation

Install update from vendor's website.

References

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-23840
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3-1_release_notes.htm
• https://www.zerodayinitiative.com/advisories/ZDI-23-1444/
• https://www.zerodayinitiative.com/advisories/ZDI-23-1443/