In the Solarwinds Orion platform, which is an IT management and monitoring solution, two critical security vulnerabilities have been identified that may cause threat actors to access sensitive/critical data and execute code on the vulnerable system.
- The SQL Injection vulnerability with code CVE-2022-36961 is caused by insufficient cleaning of user-supplied data. As a result, a remote user can run arbitrary SQL commands in the application database by sending a specially crafted request to the affected application. Successful exploitation of this vulnerability allows remote threat actors to read, delete, modify data in the database and gain full control over the affected application.
- The security vulnerability code CVE-2022-36965 is also caused by insufficient cleaning of user-supplied data and allows a remote threat actor to perform cross-site scripting (XSS) attacks. A remote threat actor can exploit the vulnerability to inject arbitrary HTML and script code into the user’s browser in the context of the vulnerable website. Successful exploitation of the vulnerability allows remote threat actors to gain access to sensitive information, alter the appearance of the affected web page, and carry out phishing and malware attacks.
These vulnerabilities affect all versions of Solarwind Orion Platform 2022.2 and earlier and have been fixed with the latest SolarWinds Platform 2022.3 release. In this context, it is recommended to implement the security updates published immediately in order not to be the target of potential attacks that can be carried out using vulnerabilities.
What do the vendor advisories add?
SolarWinds published a separate advisory for each flaw on 28 September 2022. The advisory for CVE-2022-36961 says a component of the Orion Platform was open to SQL injection. It adds that an authenticated attacker could use it to gain higher privileges or run code remotely. That is narrower than a first reading of the flaw suggests: the attacker needs a login first. The NVD record scores it 8.8 out of 10, which is High.
The advisory for CVE-2022-36965 places the cross-site scripting flaw in an input field of the QoE (Quality of Experience) application. It calls the problem stored and DOM-based cross-site scripting, and it credits the researcher Shashank Chaurasia. The NVD record gives it a base score of 6.1, which is Medium. Stored XSS is harmful because the script stays in the application and runs for every user who opens the affected page.
Both advisories list Orion Platform 2022.2 and earlier as affected, and both name SolarWinds Platform 2022.3 as the fixed release.
Why does Orion deserve fast patching?
Orion monitors networks, servers and applications. It holds credentials and sees most of the infrastructure it watches. An attacker who controls it learns a lot about the network and may be able to reach many systems from one place. Orion also has a history: in 2020 attackers hid malicious code in a signed Orion update, as CISA reported. The two 2022 flaws are unrelated to that case, but the history is a good reason to keep this product current.
What should you do?
- Check which Orion Platform version you run. Anything at 2022.2 or earlier is affected.
- Upgrade to SolarWinds Platform 2022.3 or later, following the vendor release notes.
- Limit who can log in to Orion and who can reach its web console. Use an external attack surface management scan to confirm the console is not open to the whole internet.
- Follow cyber threat intelligence reports for signs that attackers have started to use these flaws.
Sources: SolarWinds advisory for CVE-2022-36961, SolarWinds advisory for CVE-2022-36965, NVD CVE-2022-36961 and NVD CVE-2022-36965.