CVE-2024-23475: 
SolarWinds Access Rights Manager vulnerability analysis and mitigation

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal and Information Disclosure Vulnerability (CVE-2024-23475), discovered and disclosed in July 2024. This vulnerability affects versions up to and including ARM 2023.2.4, allowing unauthenticated users to perform arbitrary file deletion and leak sensitive information (Release Notes, NVD).

The vulnerability exists within the AddReportResult method and stems from inadequate validation of user-supplied paths prior to file operations. It received a Critical CVSS v3.1 score of 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (ZDI Advisory, Release Notes).

An attacker exploiting this vulnerability can read and delete arbitrary files in the context of a highly privileged domain user. The vulnerability enables unauthorized access to sensitive information and allows for file system manipulation, potentially compromising the security and integrity of the affected systems (ZDI Advisory).

The vulnerability can be exploited remotely by unauthenticated attackers, requiring no user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (ZDI Advisory).

SolarWinds has released version 2024.3 of Access Rights Manager to address this vulnerability. Organizations must upgrade from ARM 2023.2.4 to ARM 2024.3 to implement the fix. Users on versions earlier than ARM 2023.2.4 must first upgrade to 2023.2.4 before upgrading to 2024.3 (Release Notes).

The vulnerability was discovered by Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative (ZDI), who coordinated with SolarWinds for responsible disclosure. The discovery was part of a larger security audit that uncovered multiple critical vulnerabilities in the ARM software (Hacker News).