Tech Stack: SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP

Date(s) Issued: Published: 07/09/2021; Last Modified: 11/21/2024

Criticality: CVSS v3 Score: 8.8 – HIGH

Overview: CVE-2021-35211 is a remote code execution (RCE) vulnerability in SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP products. Discovered by Microsoft, this vulnerability arises from a flaw in Serv-U’s implementation of the Secure Shell (SSH) protocol. An unauthenticated, remote attacker can exploit this vulnerability to execute arbitrary code with elevated privileges on the affected system, potentially leading to full system compromise. Notably, this vulnerability has been observed being exploited in the wild by a threat actor identified as DEV-0322.

Solution/Mitigation:

1. Upgrade:
   • Serv-U Version: Upgrade to Serv-U version 15.2.3 Hotfix (HF) 2 or later, which addresses this vulnerability. SolarWinds has released this hotfix to mitigate the issue.
2. Disable SSH Protocol (Temporary Mitigation):
   • Configuration: If immediate upgrading is not feasible, disable the SSH protocol in your Serv-U environment to prevent exploitation. This can be done through the Serv-U Management Console by navigating to the domain’s settings and unchecking the option to enable SSH.
3. Restrict Network Access:
   • Firewall Rules: Ensure that access to the Serv-U SSH service is restricted to trusted IP addresses only. Implement firewall rules to block unauthorized access from untrusted sources.
4. Monitor for Indicators of Compromise (IoCs):
   • Log Analysis: Review Serv-U logs for any anomalies, such as unexpected exceptions in the DebugSocketlog.txt file, which may indicate exploitation attempts. Look for entries similar to:cssCopy codeEXCEPTION: C0000005; CSUSSHSocket::ProcessReceive (); Type: 30; puchPayLoad = 0x041ec066; nPacketLength = 76; nBytesReceived = 80; nBytesUncompressed = 156; uchPaddingLength = 5 Dataprise
5. Apply Principle of Least Privilege:
   • User Permissions: Ensure that the Serv-U service runs with the minimal necessary privileges to limit the impact of potential exploitation. Review and adjust user permissions accordingly.

Confirmation & Additional Information:

• Verification: After applying the hotfix or disabling SSH, test your Serv-U environment to confirm that the vulnerability has been mitigated. Attempt to access the SSH service to ensure it is properly disabled if that mitigation was applied.
• Stay Updated: Regularly check for updates and security advisories from SolarWinds to ensure your Serv-U installation remains secure. Subscribe to their notifications for the latest information.
• Official Resources:
  • SolarWinds Security Advisory: Rapid7
  • Microsoft Security Blog on the Vulnerability: Microsoft
  • National Vulnerability Database Entry: NVD