CVE-2024-23470: 
SolarWinds Access Rights Manager vulnerability analysis and mitigation

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a pre-authentication remote code execution vulnerability identified as CVE-2024-23470. This critical vulnerability, discovered in July 2024, allows an unauthenticated user to run commands and executables on affected systems. The vulnerability affects SolarWinds Access Rights Manager versions up to and including 2023.2.4 (Release Notes).

The specific vulnerability exists within the UserScriptHumster class and results from an exposed dangerous method. The vulnerability has received a Critical severity rating with a CVSS v3.1 base score of 9.6, with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The vulnerability is classified under CWE-287 (Improper Authentication) (NVD, ZDI).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code with SYSTEM privileges on affected installations of SolarWinds Access Rights Manager. The pre-authentication nature of the vulnerability means that attackers do not need to be authenticated to exploit it, significantly increasing its potential impact (ZDI).

The vulnerability requires no authentication to exploit and has a low attack complexity, making it highly exploitable. An attacker can leverage this vulnerability to execute code in the context of SYSTEM privileges (ZDI).

SolarWinds has addressed this vulnerability in version 2024.3, released on July 17, 2024. Organizations must upgrade to ARM 2024.3 to mitigate this vulnerability. Users must first ensure they are on ARM 2023.2.4 before upgrading to 2024.3 (Release Notes).

The vulnerability was responsibly disclosed through the Trend Micro Zero Day Initiative (ZDI) program. This vulnerability was part of a larger security update that addressed multiple critical flaws in the Access Rights Manager software (Hacker News).