A security vulnerability has been detected in the Serv-U FTP Server file-sharing solution developed by SolarWinds, allowing remote threat actors to perform Path Traversal attacks on the vulnerable system.
The vulnerability tracked as CVE-2021-35250 exists due to a validation error when processing migration sequences. Successfully exploiting a vulnerability could allow access to files on the system.
The high-severity vulnerability only affects Serv-U FTP Server version 15.3. SolarWinds has released updates that fix the vulnerability and other issues. Users using the vulnerable version are advised to apply the updates that fix the vulnerability immediately.
What does the SolarWinds advisory say?
SolarWinds published its own security advisory for CVE-2021-35250. It describes a directory traversal flaw in Serv-U 15.3 that an external researcher reported. If an attacker exploits it, files that belong to the Serv-U installation and the server could be exposed. The advisory names Serv-U 15.3 as the only affected version and Serv-U 15.3 Hotfix 1 (HF 1) as the fix. SolarWinds states that it knows of no exploitation in the wild.
The advisory rates the issue as high severity. Its CVSS 3.1 vector shows that the attack works over the network, needs no special privileges, needs no user action and has a high impact on confidentiality, with no stated impact on integrity or availability. In plain terms, someone who can reach the service from the network may be able to read files they should not see.
What is path traversal?
Path traversal, also called directory traversal, is a flaw in which a server trusts a file path sent by the user. The attacker adds sequences such as “../” to the path to climb out of the folder the service is meant to serve. Once outside it, the attacker can ask for files elsewhere on the system. Here, the weakness lies in how Serv-U handles migration sequences, as the original report notes. The result is read access to files, not a way to run code on the server.
The NVD record for the flaw is at CVE-2021-35250. Teams that track vulnerabilities can use it to match the CVE to their asset lists.
What should Serv-U administrators do?
- Check which Serv-U version each server runs. Only version 15.3 is listed as affected.
- Install Serv-U 15.3 HF 1 from the SolarWinds support site.
- Review which Serv-U servers face the internet. File-sharing servers are often exposed on purpose, so patch them first.
- Look at the server logs for unusual file requests that contain “../” style sequences.
- Remove sensitive files from the Serv-U installation folder and its parent folders where possible.
Before you act, check the vendor advisory and the NVD record.