Command injection in Orion Network Performance Monitor - CVE-2019-8917

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17774

Command injection in Orion Network Performance Monitor - CVE-2019-8917

Published: February 19, 2019


Vulnerability identifier: #VU17774
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-8917
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: SolarWinds
Affected software:
Orion Network Performance Monitor

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to an error when OrionModuleEngine service establishes a NetTcpBinding endpoint. A remote unauthenticated attacker can connect and call publicly exposed methods to abuse the InvokeActionMethod method, inject arbitrary commands and and execute arbitrary code as the SYSTEM user.

Successful exploitation of the vulnerability may result in system compromise.


How to mitigate CVE-2019-8917

Update to version 12.4.

Sources