CVE-2021-25276: SolarWinds Serv-U Privilege Escalation

CVE-2021-25276 Overview

CVE-2021-25276 is an insecure permissions vulnerability affecting SolarWinds Serv-U FTP server prior to version 15.2.2 Hotfix 1. The vulnerability exists because a directory containing user profile files—including password hashes—is configured with world-readable and world-writable permissions. This misconfiguration allows an unprivileged Windows user with local filesystem access to create arbitrary FTP users by simply copying a valid profile file into this directory, potentially achieving LocalSystem privileges for reading or replacing arbitrary files on the system.

Critical Impact

An unprivileged local attacker can escalate privileges to LocalSystem by creating malicious FTP user profiles, enabling arbitrary file read/write access across the entire filesystem.

Affected Products

• SolarWinds Serv-U versions prior to 15.2.2 Hotfix 1
• SolarWinds Serv-U 15.2.2 (without hotfix applied)

Discovery Timeline

• 2021-02-03 - CVE-2021-25276 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-25276

Vulnerability Analysis

This vulnerability stems from a fundamental access control misconfiguration in SolarWinds Serv-U's user profile management system. The Serv-U FTP server stores user profile files in a specific directory on the Windows filesystem. These profile files contain sensitive information including password hashes and user configuration settings such as home directory paths.

The core issue is that this user profile directory is configured with overly permissive Access Control Lists (ACLs), allowing any local Windows user—including unprivileged accounts—to both read existing profile files and write new ones into the directory. This represents a classic case of CWE-732: Incorrect Permission Assignment for Critical Resource.

The vulnerability enables local privilege escalation because the Serv-U service operates with LocalSystem privileges. When an attacker creates a malicious FTP user profile with a home directory set to C:\, the FTP service grants that user access to read and write files across the entire filesystem with LocalSystem permissions. This effectively transforms low-privilege local access into full system compromise.

Root Cause

The root cause is improper permission assignment (CWE-732) on the directory containing Serv-U user profile files. The directory lacks appropriate Access Control Lists to restrict read and write operations to authorized administrators and the Serv-U service account only. This design flaw allows any authenticated Windows user with local filesystem access to manipulate the FTP server's user database directly through the filesystem.

Attack Vector

Exploitation requires local access to the Windows server's filesystem where SolarWinds Serv-U is installed. The attack follows these steps:

1. The attacker, using an unprivileged Windows account, locates the Serv-U user profile directory
2. The attacker reads an existing valid profile file to understand the file format and structure
3. The attacker creates or modifies a profile file to define a new FTP user with a known password hash and sets the home directory to C:\ or another sensitive path
4. The attacker copies this malicious profile file into the world-writable profile directory
5. The Serv-U service loads the new profile, creating the attacker-controlled FTP user
6. The attacker authenticates to the FTP service with the new credentials and gains LocalSystem-level access to files on the system

The attack is particularly dangerous because it requires no service restart—the new user profile becomes active immediately upon being written to the directory.

Detection Methods for CVE-2021-25276

Indicators of Compromise

• Unexpected or unauthorized user profile files appearing in the Serv-U user profile directory
• FTP user accounts that were not created through the Serv-U management interface
• Anomalous FTP authentication events for unknown user accounts
• File access logs showing FTP service reading or writing files outside of expected directories

Detection Strategies

• Monitor the Serv-U user profile directory for file creation events using Windows security auditing or endpoint detection tools
• Implement file integrity monitoring (FIM) on the Serv-U installation directory and user profile storage locations
• Audit Windows Event Logs for object access events targeting the vulnerable directory path
• Review FTP server logs for authentication attempts using unexpected usernames

Monitoring Recommendations

• Deploy SentinelOne endpoint protection to detect and alert on suspicious file system activity targeting Serv-U directories
• Enable Windows Advanced Audit Policy for file system object access on sensitive Serv-U paths
• Configure alerting for new user profile file creation outside of normal administrative workflows
• Establish baseline of legitimate Serv-U user profiles and alert on deviations

How to Mitigate CVE-2021-25276

Immediate Actions Required

• Upgrade SolarWinds Serv-U to version 15.2.2 Hotfix 1 or later immediately
• Audit existing user profile files for any unauthorized or suspicious entries
• Review Windows ACLs on the Serv-U user profile directory and restrict permissions to administrators and the Serv-U service account only
• Examine FTP server logs for signs of unauthorized access or suspicious user activity

Patch Information

SolarWinds has addressed this vulnerability in Serv-U 15.2.2 Hotfix 1. Organizations should apply this update as the primary remediation measure. For detailed technical analysis and additional context on this vulnerability, refer to the Trustwave SpiderLabs Blog.

Workarounds

• Manually restrict NTFS permissions on the Serv-U user profile directory to remove access for unprivileged users while maintaining access for administrators and the service account
• Implement application whitelisting to prevent unauthorized modifications to Serv-U configuration files
• Limit local access to servers running Serv-U to only essential personnel
• Consider network segmentation to reduce the exposure of file transfer services