CVE-2022-38106: SolarWinds Serv-U Path Traversal Flaw

CVE-2022-38106 Overview

CVE-2022-38106 is a Cross-Site Scripting (XSS) vulnerability affecting SolarWinds Serv-U web client versions 15.3.0 through 15.3.1. The vulnerability exists in the directory creation function, allowing authenticated attackers to inject malicious scripts that can be executed in the context of other users' browsers. This type of stored XSS vulnerability can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of legitimate users.

Critical Impact

Authenticated attackers can exploit this XSS vulnerability in the directory creation function to execute arbitrary JavaScript in victim browsers, potentially compromising user sessions and sensitive data within the Serv-U environment.

Affected Products

• SolarWinds Serv-U version 15.3.0
• SolarWinds Serv-U version 15.3.1
• SolarWinds Serv-U Web Client interface

Discovery Timeline

• 2022-12-16 - CVE-2022-38106 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-38106

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the web client's directory creation functionality, where user-supplied input is not properly sanitized before being rendered in the browser. When a user creates a directory with a specially crafted name containing malicious JavaScript, the script is stored server-side and executed whenever other users view or interact with that directory listing.

The attack requires network access and a low-privileged authenticated user account on the Serv-U system. Due to the changed scope characteristic, the impact extends beyond the vulnerable component itself, potentially affecting other users' browser sessions and data confidentiality. The vulnerability enables both confidentiality and integrity impacts through script execution in the victim's browser context.

Root Cause

The root cause of CVE-2022-38106 is improper input validation and output encoding in the Serv-U web client's directory creation handler. When processing directory names, the application fails to sanitize special characters and HTML entities before storing and subsequently rendering them in the web interface. This allows attackers to inject executable JavaScript that persists in the system and triggers when other users access the affected directory listings.

Attack Vector

The attack vector for this vulnerability is network-based and requires authentication with low privileges. An attacker must first authenticate to the Serv-U web client, then navigate to the directory creation function. By submitting a directory name containing malicious JavaScript payload, the attacker can store the script on the server. When other authenticated users—including administrators—browse to the affected directory, the malicious script executes in their browser session with their privileges.

The exploitation chain involves crafting a directory name that includes script tags or event handlers that bypass any client-side filtering. Since this is a stored XSS vulnerability, the payload persists and can affect multiple users over time, making it more dangerous than reflected XSS variants.

Detection Methods for CVE-2022-38106

Indicators of Compromise

• Unusual directory names containing HTML tags, script elements, or JavaScript event handlers such as onerror, onload, or onclick
• Web server logs showing directory creation requests with encoded or suspicious characters in the name parameter
• User reports of unexpected browser behavior or pop-ups when browsing Serv-U directories
• Session anomalies or unauthorized actions traced back to XSS payload execution

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in directory creation requests
• Monitor Serv-U web client logs for suspicious patterns in directory names including <script>, javascript:, or encoded variants
• Deploy content security policy (CSP) headers to detect and report attempted script injections
• Conduct regular security scans of the Serv-U web interface for stored XSS vulnerabilities

Monitoring Recommendations

• Enable detailed logging for all directory creation operations in the Serv-U web client
• Configure SIEM alerts for patterns matching common XSS payloads in HTTP request parameters
• Monitor for unusual session behavior that may indicate successful XSS exploitation
• Review directory listings periodically for entries containing suspicious characters or encoding

How to Mitigate CVE-2022-38106

Immediate Actions Required

• Upgrade SolarWinds Serv-U to version 15.3.2 or later immediately
• Review existing directory names for potentially malicious content and remove suspicious entries
• Implement web application firewall rules to filter XSS payloads as a defense-in-depth measure
• Enforce strict content security policies (CSP) to limit script execution sources

Patch Information

SolarWinds has addressed this vulnerability in Serv-U version 15.3.2. Organizations should upgrade to this version or later to remediate the XSS vulnerability. Detailed release notes and patch information are available in the SolarWinds Serv-U Release Notes. Additional security advisory details can be found at the SolarWinds Security Advisory for CVE-2022-38106.

Workarounds

• Restrict access to the Serv-U web client to trusted network segments only until patching is complete
• Implement strict input validation at the network perimeter using a reverse proxy or WAF
• Disable directory creation capabilities for non-essential user accounts
• Deploy browser-based XSS protection extensions for users who must access the vulnerable system

# Configuration example - Restrict web client access by IP
# Add to Serv-U access control configuration
# Limit web client access to trusted admin subnet only
# Example firewall rule to restrict Serv-U web interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP