CVE-2024-23474: 
SolarWinds Access Rights Manager vulnerability analysis and mitigation

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability, identified as CVE-2024-23474. This vulnerability was discovered in January 2024 and publicly disclosed on July 17, 2024, affecting ARM version 2023.2.4 and prior releases (Release Notes).

The vulnerability stems from the lack of proper validation of a user-supplied path prior to using it in file operations within the deleteTransferFile method. The severity of this vulnerability is rated as High with a CVSS 3.1 base score of 8.8 (NIST) and 7.6 (SolarWinds), with the following vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD, ZDI).

An attacker can leverage this vulnerability to delete files and disclose information in the context of a highly privileged domain user. The vulnerability allows for arbitrary file deletion and information disclosure capabilities, potentially compromising sensitive system data (ZDI).

Authentication is not required to exploit this vulnerability, making it particularly dangerous. The vulnerability was reported through Trend Micro's Zero Day Initiative, and while technical details are available, there are no public reports of active exploitation in the wild (SecurityWeek).

SolarWinds has addressed this vulnerability in Access Rights Manager version 2024.3, released on July 17, 2024. Users are strongly advised to update their Access Rights Manager installations to this version. To upgrade to ARM 2024.3, users must first ensure they are on ARM 2023.2.4 before proceeding with the upgrade (Release Notes).