CVE-2024-28992: 
SolarWinds Access Rights Manager vulnerability analysis and mitigation

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal and Information Disclosure Vulnerability (CVE-2024-28992), discovered and disclosed in July 2024. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information, affecting versions prior to ARM 2024.3 (Release Notes).

The vulnerability exists within the deleteTransferFile method, stemming from inadequate validation of user-supplied paths prior to file operations. It has received a CVSS v3.1 base score of 7.6 HIGH, with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-287 (Improper Authentication) (ZDI Advisory).

An attacker can leverage this vulnerability to delete files and disclose information in the context of a highly privileged domain user. The vulnerability poses significant risks to system integrity and data confidentiality (ZDI Advisory).

While the vulnerability requires no authentication to exploit, there have been no reports of active exploitation in the wild. The vulnerability was discovered by Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative (Arctic Wolf).

SolarWinds has released version 2024.3 of Access Rights Manager to address this vulnerability. Organizations must upgrade from versions prior to ARM 2024.3 to the latest version to mitigate the risk. Users must be on ARM 2023.2.4 before upgrading to ARM 2024.3 (Release Notes).

The vulnerability was responsibly disclosed through Trend Micro's Zero Day Initiative (ZDI), demonstrating effective coordination between security researchers and vendors. SolarWinds acknowledged and thanked ZDI for their partnership in coordinating the responsible disclosure (Release Notes).