PT-2021-17346 · Solarwinds · Solarwinds Patch Manager

Harrison Neal · Published 2021-02-24 · Updated 2021-04-01 · CVE-2021-27240

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SolarWinds Patch Manager version 2020.2.1

Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the DataGridService WCF service due to the lack of proper validation of user-supplied data, resulting in deserialization of untrusted data. This can be leveraged to escalate privileges and execute arbitrary code in the context of Administrator.

Recommendations: For SolarWinds Patch Manager version 2020.2.1, consider disabling the DataGridService WCF service as a temporary workaround until a patch is available. Restrict access to the DataGridService to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-27240

ZDI-21-207

Affected Products

Solarwinds Patch Manager

References · 3

• https://zerodayinitiative.com/advisories/ZDI-21-207 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27240 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27240 · Vendor Advisory