PT-2021-16495 · Microsoft+1 · Message Queue+1

Martin Rakhmanov · Published 2021-02-03 · Updated 2021-02-08 · CVE-2021-25274

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform versions prior to 2020.2.4

Description: The issue concerns the Collector Service in the SolarWinds Orion Platform, which uses Microsoft Message Queue (MSMQ) and fails to set proper permissions on its private queues. This allows remote unauthenticated clients to send messages to TCP port 1801, which are then processed by the Collector Service. Furthermore, the service deserializes these messages in an insecure manner, enabling remote arbitrary code execution as LocalSystem.

Recommendations: For versions prior to 2020.2.4, update to version 2020.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to TCP port 1801 to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-25274

Affected Products

Message Queue

Solarwinds Orion Platform

References · 5

• 🔥 https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2021-25274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25274 · Security Note
• https://t.me/true_secator/1393 · Telegram Post
• https://t.me/ckure/6771 · Telegram Post