CVE-2021-35250: SolarWinds Serv-U Path Traversal Flaw

CVE-2021-35250 Overview

CVE-2021-35250 is a Directory Traversal vulnerability affecting SolarWinds Serv-U version 15.3. This vulnerability allows unauthenticated remote attackers to access files outside the intended directory structure, potentially exposing sensitive files related to the Serv-U installation and server configuration. The vulnerability has been addressed in Serv-U 15.3 Hotfix 1.

Critical Impact

Unauthenticated attackers can exploit this directory traversal flaw over the network to read sensitive server files and Serv-U installation data without any user interaction or special privileges.

Affected Products

• SolarWinds Serv-U 15.3

Discovery Timeline

• 2022-04-25 - CVE-2021-35250 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-35250

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) in SolarWinds Serv-U 15.3 allows attackers to break out of the intended file system boundaries and access arbitrary files on the server. The vulnerability requires no authentication and can be exploited remotely over the network with low attack complexity.

The impact of successful exploitation is limited to confidentiality — attackers can read sensitive files but cannot modify data or disrupt service availability. This includes potential access to Serv-U configuration files, server logs, and other sensitive installation data that could reveal further attack vectors or sensitive information.

Root Cause

The root cause of this vulnerability lies in improper input validation within the Serv-U file transfer server. The application fails to properly sanitize user-supplied input containing path traversal sequences (such as ../ or encoded variants). When processing file requests, the application does not adequately verify that the requested path remains within the allowed directory structure, enabling attackers to navigate to parent directories and access files outside the intended scope.

Attack Vector

The attack vector is network-based, meaning attackers can exploit this vulnerability remotely without requiring local access to the target system. The exploitation process involves:

1. An attacker sends a specially crafted request to the Serv-U server containing directory traversal sequences
2. The server processes the malicious path without proper validation
3. The attacker gains read access to files outside the intended directory, including Serv-U installation files and potentially other server files

The vulnerability does not require authentication, meaning any network-accessible Serv-U 15.3 instance is potentially vulnerable to unauthenticated file disclosure attacks.

Detection Methods for CVE-2021-35250

Indicators of Compromise

• Unusual file access patterns in Serv-U logs showing requests containing ../ sequences or encoded path traversal characters
• Access attempts targeting sensitive configuration files like Serv-U.ini or system files outside normal FTP directories
• Network traffic containing suspicious path manipulation attempts directed at the Serv-U service port

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns such as ../, ..%2f, %2e%2e/, and similar encoded variants
• Monitor Serv-U access logs for requests attempting to access files outside designated transfer directories
• Deploy network intrusion detection systems (NIDS) with signatures for directory traversal attack patterns targeting FTP/file transfer services

Monitoring Recommendations

• Enable verbose logging on Serv-U servers to capture all file access requests with full path information
• Set up alerts for any file access attempts outside of configured user home directories
• Regularly audit Serv-U logs for reconnaissance patterns that may precede exploitation attempts

How to Mitigate CVE-2021-35250

Immediate Actions Required

• Upgrade SolarWinds Serv-U to version 15.3 Hotfix 1 or later immediately
• Restrict network access to Serv-U servers to only trusted IP ranges using firewall rules
• Audit recent access logs to identify any potential exploitation attempts prior to patching
• Review and minimize file system permissions for the Serv-U service account

Patch Information

SolarWinds has released Serv-U 15.3 Hotfix 1 to address this vulnerability. Administrators should download and apply the hotfix from the official SolarWinds support portal. For detailed patch instructions, refer to the SolarWinds Serv-U Hotfix documentation and the SolarWinds CVE-2021-35250 Security Advisory.

Workarounds

• Implement network segmentation to limit exposure of Serv-U servers to untrusted networks
• Configure firewall rules to restrict access to Serv-U services from only authorized IP addresses
• Deploy a reverse proxy or web application firewall in front of Serv-U to filter malicious requests containing path traversal patterns
• If immediate patching is not possible, consider temporarily disabling the Serv-U service until the hotfix can be applied

# Configuration example - Firewall rule to restrict Serv-U access
# Allow only trusted IP ranges to access Serv-U on default ports
iptables -A INPUT -p tcp --dport 21 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP