PT-2023-6826 · Solarwinds · Solarwinds Orion Platform +2

Chudypb + 1 · Published 2023-02-15 · Updated 2023-08-03 · CVE-2023-23836

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SolarWinds Platform version 2022.4.1

Description The issue is related to the deserialization of untrusted data in the SolarWinds Orion Platform, which can be exploited by a remote adversary with admin-level access to the SolarWinds Web Console. This allows the execution of arbitrary commands. The vulnerability is associated with deficiencies in the deserialization mechanism.

Recommendations For SolarWinds Platform version 2022.4.1, consider disabling the

CredentialInitializer

function as a temporary workaround until a patch is available. Restrict access to the SolarWinds Web Console to minimize the risk of exploitation. Avoid using the deserialization mechanism with untrusted data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-07700

CVE-2023-23836

ZDI-23-170

Affected Products

Solarwinds Orion Platform

Solarwinds Platform

Solarwinds Web Console

References · 9

• https://zerodayinitiative.com/advisories/ZDI-23-170 · Security Note
• https://solarwinds.com/trust-center/security-advisories/CVE-2023-23836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23836 · Security Note
• https://bdu.fstec.ru/vul/2023-07700 · Security Note
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm · Note
• https://t.me/cibsecurity/58275 · Telegram Post
• https://t.me/true_secator/4088 · Telegram Post
• https://t.me/cvenotify/44399 · Telegram Post
• https://t.me/cvenotify/55744 · Telegram Post