CVE-2021-3154: SolarWinds Serv-U Info Disclosure Flaw

CVE-2021-3154 Overview

CVE-2021-3154 is an information disclosure vulnerability affecting SolarWinds Serv-U versions before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords by abusing macro injection in the Serv-U file transfer product. The flaw is classified under [CWE-74] for improper neutralization of special elements in output used by a downstream component (injection). SolarWinds shipped a fix in Serv-U 15.2.2 that is distinct from the earlier patch for CVE-2020-35481.

Critical Impact
Remote, unauthenticated attackers can extract cleartext credentials from Serv-U deployments, enabling account takeover and lateral movement against managed file transfer infrastructure.

Affected Products

SolarWinds Serv-U versions prior to 15.2.2
SolarWinds Serv-U File Server
SolarWinds Serv-U Managed File Transfer Server

Discovery Timeline

2021-05-04 - CVE-2021-3154 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3154

Vulnerability Analysis

The vulnerability resides in Serv-U's macro processing logic. Serv-U supports macros — placeholders such as user, path, and system variables — that the server expands at runtime when rendering certain responses or messages. Versions before 15.2.2 do not properly restrict which macros an unauthenticated requester can trigger or which server-side values those macros are permitted to dereference.

An attacker who supplies crafted input containing macro tokens can coerce the server into expanding macros that resolve to stored credential material. The expanded value is returned to the client in cleartext, bypassing the access controls that would normally protect those secrets. Because the attack succeeds without authentication and across the network, the exposure scope includes any account whose credentials are retrievable through the abused macro paths.

SolarWinds notes that this issue required a separate fix from CVE-2020-35481, indicating that the earlier patch did not fully eliminate the macro injection surface. The EPSS score reflects above-average exploitation likelihood relative to the broader CVE population.

Root Cause

The root cause is improper neutralization of macro syntax in attacker-controlled input fields. Serv-U interpolates macro tokens before applying authorization checks on the data those tokens resolve to. Combined with a macro set that can reference credential storage, this yields an unauthenticated read primitive over sensitive configuration values.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker sends a request to a reachable Serv-U service containing macro tokens crafted to expand to stored password material. The server processes the macros and returns the resolved cleartext string in its response. No authenticated session, file system access, or specific client software is required.

No public proof-of-concept code is referenced in the available vendor data. Technical details are described in prose in the SolarWinds Serv-U 15.2.2 Release Notes.

Detection Methods for CVE-2021-3154

Indicators of Compromise

Inbound requests to Serv-U management or FTP/HTTP interfaces containing macro delimiter sequences (for example, $ or % wrapped tokens) in username, path, or message fields.
Serv-U responses or log entries that contain rendered credential strings or fields that should never appear in client-facing output.
Authentication anomalies on accounts whose credentials are stored on the Serv-U host, particularly logins from new geographies shortly after probing activity.

Detection Strategies

Inspect Serv-U DebugLogs and audit logs for unauthenticated sessions submitting inputs containing macro syntax characters across multiple fields.
Hunt across web and FTP proxy logs for requests targeting Serv-U endpoints with payloads that include macro tokens or unusually long parameter values.
Correlate Serv-U process telemetry with outbound responses sized larger than baseline for unauthenticated endpoints, which can indicate credential leakage in responses.

Monitoring Recommendations

Forward Serv-U server logs to a centralized analytics platform and alert on requests containing macro delimiter patterns from unauthenticated sources.
Monitor any service account credentials stored in Serv-U for unexpected use, and rotate them on suspicion of exposure.
Track the installed Serv-U build version across the estate and alert when hosts run versions earlier than 15.2.2.

How to Mitigate CVE-2021-3154

Immediate Actions Required

Upgrade all Serv-U installations to version 15.2.2 or later, which contains the vendor fix for this issue.
Rotate every account password and API key stored in or used by Serv-U, including service accounts and integrated AD credentials.
Restrict network exposure of Serv-U management and file transfer interfaces to known administrative networks until patching is complete.
Review Serv-U logs for the past 90 days for requests containing macro syntax from unauthenticated clients and treat matches as suspected credential exposure.

Patch Information

SolarWinds addressed CVE-2021-3154 in Serv-U 15.2.2. Refer to the SolarWinds Serv-U 15.2.2 Release Notes for the fixed build and upgrade procedure. The fix is distinct from and supersedes the earlier remediation released for CVE-2020-35481.

Workarounds

Place Serv-U behind a reverse proxy or web application firewall configured to block requests containing macro delimiter characters in authentication and path fields.
Disable or firewall any Serv-U listener that does not require external exposure, reducing the unauthenticated attack surface.
Apply network segmentation so that Serv-U hosts cannot reach high-value internal systems with the credentials they store.

bash

# Verify installed Serv-U version on Windows hosts
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\RhinoSoft.com\Serv-U" `
  | Select-Object Version, InstallPath

# Example WAF rule fragment: block macro delimiters in login fields
# (Adapt regex to your WAF syntax)
SecRule ARGS:user|ARGS:path "@rx [\$%]\w+[\$%]" \
  "id:1003154,phase:2,deny,status:403,msg:'Serv-U macro injection attempt (CVE-2021-3154)'"