CVE-2020-10148: 
SolarWinds Platform vulnerability analysis and mitigation

The SolarWinds Orion API contains an authentication bypass vulnerability (CVE-2020-10148) that could allow remote attackers to execute API commands without authentication. The vulnerability affects SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1. This vulnerability was publicly disclosed on December 26, 2020 (CERT VU, NVD).

The vulnerability exists in the SolarWinds Orion API authentication mechanism. An attacker can bypass authentication by including specific parameters in the Request.PathInfo portion of a URI request. Specifically, if an attacker appends PathInfo parameters like WebResource.axd, ScriptResource.axd, i18n.ashx, or Skipi18n to a request, the system may set the SkipAuthorization flag, allowing API requests to be processed without authentication (CERT VU). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 Critical (AttackerKB).

This vulnerability could allow remote attackers to bypass authentication and execute API commands, potentially resulting in a complete compromise of the SolarWinds instance. The vulnerability has been linked to the deployment of SUPERNOVA malware in target environments (Hacker News, CERT VU).

SolarWinds has released multiple patches to address this vulnerability. Users should upgrade to one of the following versions: 2019.4 HF 6 (released December 14, 2020), 2020.2.1 HF 2 (released December 15, 2020), 2019.2 SUPERNOVA Patch (released December 23, 2020), 2018.4 SUPERNOVA Patch (released December 23, 2020), or 2018.2 SUPERNOVA Patch (released December 23, 2020). For systems that cannot be immediately updated, SolarWinds has provided a mitigation script available for download (CERT VU, SolarWinds Advisory).

The vulnerability gained significant attention due to its potential connection to the broader SolarWinds supply chain attack. Security researchers and organizations, including CISA, advised immediate patching of affected systems. Will Dormann from CERT noted the distinction between this vulnerability and other SolarWinds-related issues (AttackerKB).