CVE-2021-25275: SolarWinds Orion Information Disclosure

CVE-2021-25275 Overview

CVE-2021-25275 is a hardcoded credentials vulnerability affecting SolarWinds Orion Platform before version 2020.2.4. The platform installs and uses a SQL Server backend, but critically stores database credentials in a file that is readable by unprivileged users on the filesystem. This insecure credential storage allows any local user with filesystem access to extract database login credentials, including the username and password, enabling unauthorized access to the SWNetPerfMon.DB database with database owner privileges.

Critical Impact

Successful exploitation grants attackers database owner access to the SolarWinds monitoring database, allowing them to access all collected monitoring data and escalate to full administrative access by manipulating authentication records in the Accounts table.

Affected Products

• SolarWinds Orion Platform versions prior to 2020.2.4
• Various SolarWinds products utilizing the Orion Platform backend
• Any deployment using the default SQL Server backend configuration

Discovery Timeline

• 2021-02-03 - CVE-2021-25275 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-25275

Vulnerability Analysis

This vulnerability stems from a fundamental security misconfiguration in how SolarWinds Orion Platform handles database credential storage. The platform stores SQL Server connection credentials in a configuration file without proper access controls, making these sensitive credentials accessible to any user with local filesystem access.

Once an attacker obtains these credentials, they can connect directly to the SQL Server backend with database owner privileges on the SWNetPerfMon.DB database. This level of access provides complete control over the monitoring data collected by SolarWinds applications across the enterprise. More critically, the attacker can manipulate the Accounts table within the database to either insert new administrator accounts or modify existing authentication data, effectively granting themselves administrative access to the SolarWinds applications.

The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials), reflecting the improper storage and protection of sensitive authentication information.

Root Cause

The root cause of this vulnerability is the insecure storage of database credentials in a file with overly permissive access controls. The SolarWinds Orion Platform fails to properly restrict read access to the configuration file containing SQL Server credentials, violating the principle of least privilege. Any unprivileged local user can read this file to obtain the database authentication details.

Attack Vector

This is a local attack vector vulnerability requiring the attacker to have filesystem access to the SolarWinds Orion Platform installation. The attack sequence involves:

1. Gaining local access to the system hosting the SolarWinds Orion Platform
2. Locating and reading the configuration file containing database credentials
3. Extracting the SQL Server login name and password from the file
4. Connecting to the SQL Server backend using the extracted credentials
5. Accessing the SWNetPerfMon.DB database with database owner privileges
6. Exfiltrating collected monitoring data or manipulating the Accounts table to gain administrative access to SolarWinds applications

The vulnerability does not require elevated privileges to exploit—any local user with basic filesystem read permissions can access the stored credentials and escalate their access to the database and subsequently to the SolarWinds administrative interface.

Detection Methods for CVE-2021-25275

Indicators of Compromise

• Unexpected database connections to SWNetPerfMon.DB from non-application accounts or unusual source addresses
• Unauthorized read access attempts on SolarWinds configuration files containing credential information
• New or modified entries in the Accounts table of the SolarWinds database
• Unusual SQL Server login events using the SolarWinds service account credentials

Detection Strategies

• Monitor file access logs for read operations on SolarWinds configuration files by non-administrative users
• Implement SQL Server auditing to track login attempts and queries against the SWNetPerfMon.DB database
• Review database audit logs for modifications to the Accounts table or other authentication-related tables
• Deploy endpoint detection and response (EDR) solutions to identify credential extraction attempts

Monitoring Recommendations

• Enable and review Windows Security Event logs for file access events (Event ID 4663) on SolarWinds configuration directories
• Configure SQL Server login auditing to capture both successful and failed authentication attempts
• Implement database activity monitoring to detect unauthorized queries or data modifications
• Use SentinelOne to monitor for suspicious process behavior associated with credential harvesting activities

How to Mitigate CVE-2021-25275

Immediate Actions Required

• Upgrade SolarWinds Orion Platform to version 2020.2.4 or later immediately
• Restrict filesystem permissions on configuration files containing database credentials to only the required service accounts
• Rotate SQL Server credentials used by the SolarWinds platform after patching
• Audit the Accounts table for any unauthorized or suspicious entries

Patch Information

SolarWinds has addressed this vulnerability in Orion Platform version 2020.2.4 and later releases. Organizations should upgrade to the latest available version to remediate this vulnerability. For detailed information about the vulnerability and remediation guidance, refer to the Trustwave SpiderLabs security research blog.

Workarounds

• Implement strict filesystem access controls to limit read access to SolarWinds configuration files to only essential service accounts
• Use Windows file system auditing to monitor and alert on unauthorized access attempts to sensitive configuration files
• Consider network segmentation to limit which systems can connect to the SQL Server backend
• Implement database access controls to restrict connections to the SWNetPerfMon.DB database to authorized application servers only
• Deploy host-based intrusion detection to identify credential extraction attempts

# Example: Restrict access to SolarWinds configuration directory
# Run as Administrator on Windows
icacls "C:\Program Files (x86)\SolarWinds\Orion" /inheritance:r
icacls "C:\Program Files (x86)\SolarWinds\Orion" /grant:r "NT SERVICE\SolarWinds*:(OI)(CI)F"
icacls "C:\Program Files (x86)\SolarWinds\Orion" /grant:r "BUILTIN\Administrators:(OI)(CI)F"