PT-2021-5143 · Solarwinds · Solarwinds Orion Platform

Jangggggg · Published 2021-06-04 · Updated 2021-11-03 · CVE-2021-35215

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions SolarWinds Orion Platform version 2020.2.5

Description Insecure deserialization in the Orion Platform leads to Remote Code Execution. This issue is related to the deserialization of untrusted data in the ActionPluginBaseView component, allowing a remote attacker to execute arbitrary code. Authentication is required to exploit this vulnerability.

Recommendations For SolarWinds Orion Platform version 2020.2.5, consider disabling the deserialization functionality in the ActionPluginBaseView component as a temporary workaround until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-05937

CVE-2021-35215

ZDI-21-1245

Affected Products

Solarwinds Orion Platform

References · 13

• 🔥 https://github.com/Y4er/CVE-2021-35215 · Exploit
• https://osv.dev/vulnerability/CVE-2021-35215 · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/cve-2021-35215 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1245 · Security Note
• https://bdu.fstec.ru/vul/2021-05937 · Security Note
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35215 · Security Note
• https://t.me/secharvester/11628 · Telegram Post
• https://documentation.solarwinds.co/enm/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm · Note
• https://t.me/cibsecurity/28180 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021102609 · Note
• https://t.me/cvenotify/22940 · Telegram Post
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-SolarWinds-Orion-Platform-ActionPluginBaseView-Deserialization-of-Untrusted-Data-Remote-Code-Execution-RCE-Vulnerability-in-Orion-Platform-2020-2-5?language=en_US · Note