CVE-2022-38108: SolarWinds Orion Platform RCE Vulnerability

CVE-2022-38108 Overview

CVE-2022-38108 is an insecure deserialization vulnerability in the SolarWinds Platform (formerly Orion Platform) that allows authenticated remote adversaries with Orion admin-level account access to execute arbitrary commands on the underlying server. The vulnerability exists in the SolarWinds Information Service (SWIS) and can be exploited through the SolarWinds Web Console to achieve remote code execution.

Critical Impact

Authenticated attackers with admin-level access to SolarWinds Web Console can execute arbitrary commands on the host system, potentially leading to complete system compromise, data exfiltration, lateral movement, and persistent access to critical network monitoring infrastructure.

Affected Products

• SolarWinds Orion Platform versions prior to 2022.4
• SolarWinds Orion Platform 2020.2.6 (including Hotfix 1 through Hotfix 5)
• SolarWinds Orion Platform 2022.2 and 2022.3

Discovery Timeline

• 2022-10-20 - CVE-2022-38108 published to NVD
• 2025-05-08 - Last updated in NVD database

Technical Details for CVE-2022-38108

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a well-known class of vulnerabilities that allows attackers to manipulate serialized objects to execute malicious code. The SolarWinds Information Service (SWIS) improperly handles deserialization of user-supplied data, enabling authenticated administrators to craft malicious serialized objects that execute arbitrary commands when processed by the server.

The attack requires network access to the SolarWinds Web Console and valid credentials with Orion administrator-level privileges. While the authentication requirement reduces the attack surface, compromised admin credentials or insider threats could leverage this vulnerability to achieve full system control. Given SolarWinds' role as a network monitoring solution deployed in enterprise environments, successful exploitation could provide attackers with visibility into critical infrastructure and serve as a pivot point for further attacks.

Root Cause

The root cause of CVE-2022-38108 is the improper validation and handling of serialized data within the SolarWinds Information Service (SWIS). The application accepts and deserializes untrusted data from authenticated admin users without adequate validation, allowing specially crafted serialized objects to trigger arbitrary code execution during the deserialization process. This design flaw enables attackers to inject malicious payloads that are executed in the context of the SolarWinds service account.

Attack Vector

The attack is conducted over the network through the SolarWinds Web Console interface. An attacker who has obtained Orion admin-level credentials can submit malicious serialized data to the vulnerable SWIS component. The attack does not require user interaction and can be executed remotely. Upon successful exploitation, the attacker gains the ability to execute arbitrary operating system commands with the privileges of the SolarWinds service account, typically running with elevated permissions on Windows Server systems.

Detailed technical information about the exploitation mechanism is available in the Zero Day Initiative Advisory ZDI-CAN-17531 and the Packet Storm RCE Exploit documentation.

Detection Methods for CVE-2022-38108

Indicators of Compromise

• Unusual process execution spawned from SolarWinds service processes (e.g., SolarWinds.BusinessLayerHost.exe, SolarWinds.Collector.Service.exe)
• Unexpected outbound network connections from SolarWinds servers to external IP addresses
• Authentication logs showing admin-level access from unfamiliar IP addresses or at unusual times
• Windows Event Logs indicating suspicious command execution or PowerShell activity on SolarWinds hosts

Detection Strategies

• Monitor SolarWinds Web Console authentication logs for anomalous admin-level login patterns or credential abuse
• Implement endpoint detection rules to identify deserialization attack patterns and suspicious child processes from SolarWinds services
• Deploy network monitoring to detect unusual SWIS traffic patterns or malformed requests to the SolarWinds API
• Enable Windows command-line and PowerShell logging on SolarWinds hosts to capture post-exploitation activity

Monitoring Recommendations

• Configure SIEM alerts for admin-level authentication events to SolarWinds Web Console, especially from external or unexpected sources
• Establish behavioral baselines for SolarWinds service processes and alert on deviations such as unexpected child processes or network connections
• Review SolarWinds audit logs regularly for configuration changes or suspicious administrative actions
• Implement file integrity monitoring on critical SolarWinds directories to detect unauthorized modifications

How to Mitigate CVE-2022-38108

Immediate Actions Required

• Upgrade SolarWinds Platform to version 2022.4 or later immediately to address this vulnerability
• Review and audit all Orion administrator accounts, removing unnecessary privileges and disabling inactive accounts
• Implement network segmentation to restrict access to SolarWinds Web Console to authorized management networks only
• Enable multi-factor authentication (MFA) for all SolarWinds administrative accounts

Patch Information

SolarWinds has released a security update addressing CVE-2022-38108. Organizations should upgrade to SolarWinds Platform version 2022.4 or later to remediate this vulnerability. Detailed patch information and upgrade instructions are available in the SolarWinds Security Advisory CVE-2022-38108.

Workarounds

• Restrict network access to the SolarWinds Web Console by implementing firewall rules that allow connections only from trusted management IP addresses
• Implement strict access controls limiting Orion admin-level privileges to essential personnel only
• Deploy web application firewalls (WAF) in front of SolarWinds Web Console to inspect and filter potentially malicious requests
• Monitor and log all administrative access to SolarWinds infrastructure pending patch deployment

# Example: Restrict SolarWinds Web Console access via Windows Firewall
# Allow access only from trusted management subnet (adjust IP range as needed)
netsh advfirewall firewall add rule name="SolarWinds Console - Restricted Access" dir=in action=allow protocol=tcp localport=443 remoteip=10.0.100.0/24
netsh advfirewall firewall add rule name="SolarWinds Console - Block All Other" dir=in action=block protocol=tcp localport=443