PT-2015-4276 · Solarwinds · Solarwinds Orion Platform+8

Brandonprry · Published 2015-03-10 · Updated 2015-03-11 · CVE-2014-9566

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Solarwinds Orion Platform version 2015.1 Network Performance Monitor (NPM) versions prior to 11.5 NetFlow Traffic Analyzer (NTA) versions prior to 4.1 Network Configuration Manager (NCM) versions prior to 7.3.2 IP Address Manager (IPAM) versions prior to 4.3 User Device Tracker (UDT) versions prior to 3.2 VoIP & Network Quality Manager (VNQM) versions prior to 4.2 Server & Application Manager (SAM) versions prior to 6.2 Web Performance Monitor (WPM) versions prior to 2.2

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the dir or sort parameter to the "GetAccounts" or "GetAccountGroups" endpoint.

Recommendations For Solarwinds Orion Platform version 2015.1, update to a version later than 2015.1. For Network Performance Monitor (NPM) versions prior to 11.5, update to version 11.5 or later. For NetFlow Traffic Analyzer (NTA) versions prior to 4.1, update to version 4.1 or later. For Network Configuration Manager (NCM) versions prior to 7.3.2, update to version 7.3.2 or later. For IP Address Manager (IPAM) versions prior to 4.3, update to version 4.3 or later. For User Device Tracker (UDT) versions prior to 3.2, update to version 3.2 or later. For VoIP & Network Quality Manager (VNQM) versions prior to 4.2, update to version 4.2 or later. For Server & Application Manager (SAM) versions prior to 6.2, update to version 6.2 or later. For Web Performance Monitor (WPM) versions prior to 2.2, update to version 2.2 or later. As a temporary workaround, consider restricting access to the "GetAccounts" and "GetAccountGroups" endpoints until a patch is available. Avoid using the dir and sort parameters in these endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-9566

Affected Products

Ip Address Manager

Netflow Traffic Analyzer

Network Configuration Manager

Network Performance Monitor

Server & Application Manager

Solarwinds Orion Platform

User Device Tracker

Voip & Network Quality Manager

Web Performance Monitor

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/solarwinds_orion_sqli.rb · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Mar/18 · Exploit
• 🔥 http://volatile-minds.blogspot.com/2015/02/authenticated-stacked-sql-injection-in.html · Exploit
• 🔥 https://exploit-db.com/exploits/36262 · Exploit
• 🔥 http://exploit-db.com/exploits/36262 · Exploit
• 🔥 http://packetstormsecurity.com/files/130637/Solarwinds-Orion-Service-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9566 · Security Note
• http://solarwinds.com/documentation/orion/docs/releasenotes/releasenotes.htm · Vendor Advisory
• https://github.com/rapid7/metasploit-framework/pull/4836 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9566 · Note
• http://osvdb.org/show/osvdb/118746 · Note