CVE-2024-23466: SolarWinds Access Rights Manager RCE Flaw

CVE-2024-23466 Overview

CVE-2024-23466 is a directory traversal vulnerability in SolarWinds Access Rights Manager (ARM) that leads to remote code execution. An unauthenticated attacker on an adjacent network can traverse the file system and execute code with SYSTEM privileges. The flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

SolarWinds addressed the issue in the ARM 2024.3 release. Access Rights Manager is widely deployed in enterprise environments to audit and manage permissions across Active Directory, file servers, and Microsoft 365, making it an attractive target for lateral movement.

Critical Impact
Unauthenticated adjacent-network attackers can execute arbitrary code with SYSTEM privileges on the ARM host, resulting in full compromise of the identity governance platform.

Affected Products

SolarWinds Access Rights Manager (ARM) versions prior to 2024.3
Deployments exposing ARM services on the local or adjacent network
Windows Server hosts running the ARM service account with elevated privileges

Discovery Timeline

2024-07-17 - CVE-2024-23466 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23466

Vulnerability Analysis

The vulnerability resides in how SolarWinds Access Rights Manager processes file path input received over the network. ARM fails to canonicalize and validate supplied pathnames before using them in file system operations. An attacker can supply crafted path sequences containing traversal characters such as ..\ to escape the intended directory scope.

Because ARM runs with SYSTEM-level privileges on Windows, successful traversal into writable or executable locations lets the attacker plant or execute code in the security context of the host. The exploitation path does not require authentication, and no user interaction is needed on the target.

The attack surface is limited to the adjacent network, meaning the attacker must be positioned on the same logical broadcast domain or reachable network segment as the ARM instance. Confidentiality, integrity, and availability are all impacted at the highest level once code execution is achieved.

Root Cause

The root cause is improper input validation of file path parameters processed by ARM services. The application accepts pathnames from untrusted sources and passes them to file handling routines without stripping traversal sequences or enforcing an allow list of directories. This classic CWE-22 pattern converts a file access primitive into a code execution primitive when combined with elevated service privileges.

Attack Vector

An attacker sends a crafted request to a vulnerable ARM endpoint that accepts file path input. The request encodes directory traversal sequences that break out of the expected directory. The attacker writes or references a payload that ARM then executes under the SYSTEM account, achieving unauthenticated remote code execution across the adjacent network.

Refer to the SolarWinds ARM 2024.3 Release Notes for vendor-supplied technical context.

Detection Methods for CVE-2024-23466

Indicators of Compromise

Unexpected child processes spawned by the ARM service executable running as NT AUTHORITY\SYSTEM
Files written to ARM installation directories or Windows system paths outside normal update workflows
Inbound network connections to ARM service ports from unusual internal hosts or VLAN segments
Requests to ARM endpoints containing traversal sequences such as ..\, ..%2f, or %2e%2e%5c

Detection Strategies

Inspect ARM application and Windows Event logs for anomalous file access patterns from the service account
Correlate authentication and process telemetry to flag ARM processes launching cmd.exe, powershell.exe, or rundll32.exe
Alert on writes to executable file types under ARM directories from non-installer parent processes

Monitoring Recommendations

Enable command-line and process creation auditing (Event ID 4688) on all ARM hosts
Forward ARM host telemetry to a centralized data lake for retrospective hunting on traversal patterns
Baseline normal ARM network peers and alert on connections from workstations or unmanaged devices

How to Mitigate CVE-2024-23466

Immediate Actions Required

Upgrade all SolarWinds Access Rights Manager deployments to version 2024.3 or later
Restrict network access to ARM services using firewall rules that only permit administrative subnets
Review ARM service account privileges and ensure hosts are isolated from general user networks
Audit ARM hosts for signs of prior exploitation, including unexpected files and scheduled tasks

Patch Information

SolarWinds released the fix in Access Rights Manager 2024.3. Full remediation details are documented in the SolarWinds ARM 2024.3 Release Notes. Apply the update on all ARM servers, including standby and disaster recovery nodes, and validate the version after installation.

Workarounds

Place ARM servers on a dedicated management VLAN with strict access control lists until patching is complete
Block inbound traffic to ARM service ports from user endpoints and untrusted network segments
Require VPN or jump host access for administrators managing the ARM console

bash

# Example Windows Firewall rule limiting ARM access to a management subnet
New-NetFirewallRule -DisplayName "Restrict ARM Management" `
  -Direction Inbound `
  -Program "C:\Program Files\SolarWinds\ARM\ARM.Server.exe" `
  -RemoteAddress 10.10.50.0/24 `
  -Action Allow