CVE-2021-25275: 
SolarWinds Platform vulnerability analysis and mitigation

SolarWinds Orion Platform before 2020.2.4 contains a vulnerability (CVE-2021-25275) where database credentials used to access the SQL Server backend are stored in a file readable by unprivileged users. The vulnerability was discovered in early 2021 and affects various SolarWinds products that use the Orion Platform (NVD, Trustwave).

The vulnerability exists because database credentials to access the backend are stored in a configuration file that is readable by any authenticated Windows user. The credentials provide database owner (DBO) access to the SWNetPerfMon.DB database. An unprivileged user who can log in locally or via RDP can read and decrypt the database login details from the file, including the username and password (Trustwave).

By exploiting this vulnerability, attackers can gain complete access to the SOLARWINDS_ORION database, allowing them to steal sensitive information or add new admin-level users to the Orion applications by modifying authentication data stored in the database's Accounts table (Trustwave, ZDNET).

The vulnerability requires local or RDP access to the system running SolarWinds Orion. Once an attacker has such access, they can easily read and decrypt the stored credentials using a simple decryption utility. To the best of Trustwave's knowledge, this vulnerability was not exploited in the wild before patches were released (Trustwave).

SolarWinds has released patches to address this vulnerability in Orion Platform version 2020.2.4. Organizations are strongly recommended to upgrade to this version as soon as possible to protect against potential exploitation (ZDNET).

The vulnerability received heightened scrutiny due to its discovery shortly after the major SolarWinds supply chain attack in December 2020. SolarWinds acknowledged the vulnerability and emphasized their commitment to working with customers and organizations to identify and remediate vulnerabilities across their product portfolio (ZDNET).