CVE-2024-28075: 
SolarWinds Access Rights Manager vulnerability analysis and mitigation

CVE-2024-28075 is a Remote Code Execution vulnerability affecting SolarWinds Access Rights Manager (ARM). The vulnerability was discovered by Piotr Bazydlo of Trend Micro Zero Day Initiative and disclosed in May 2024. This critical vulnerability affects ARM versions 2023.2.3 and prior, allowing authenticated users to abuse the SolarWinds service through deserialization of untrusted data (Vendor Advisory, ZDI Advisory).

The vulnerability exists within the JsonSerializationBinder class and stems from improper validation of user-supplied data, which can result in deserialization of untrusted data (CWE-502). The vulnerability has received a CVSS v3.1 base score of 9.0 (Critical) with the vector string CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating that it requires low attack complexity and low privileges to exploit (ZDI Advisory, NVD).

If successfully exploited, the vulnerability allows attackers to execute arbitrary code in the context of SYSTEM, potentially leading to complete system compromise. The critical CVSS score reflects the severe potential impact on confidentiality, integrity, and availability of the affected systems (ZDI Advisory).

The vulnerability requires authentication to exploit, though the existing authentication mechanism can potentially be bypassed. The attack vector is adjacent, meaning the attacker needs to be on the same network segment as the target (NVD, ZDI Advisory).

SolarWinds has released version 2023.2.4 of Access Rights Manager to address this vulnerability. Organizations are strongly advised to upgrade to this version immediately. Additionally, SolarWinds recommends installing ARM on a dedicated server that is neither public nor internet-facing, and implementing IP whitelisting where possible (Release Notes, Security Guide).