CVE-2024-23467: SolarWinds Access Rights Manager RCE Flaw

CVE-2024-23467 Overview

CVE-2024-23467 is a directory traversal and information disclosure vulnerability in SolarWinds Access Rights Manager (ARM). The flaw allows an unauthenticated attacker on an adjacent network to traverse the file system, disclose sensitive data, and ultimately achieve remote code execution on the affected host. The vulnerability maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). SolarWinds addressed the issue in the Access Rights Manager 2024.3 release.

Critical Impact
An unauthenticated adjacent-network attacker can traverse restricted directories, read sensitive files, and execute arbitrary code on SolarWinds Access Rights Manager hosts.

Affected Products

SolarWinds Access Rights Manager (ARM) — versions prior to 2024.3
solarwinds:access_rights_manager (all supported prior releases identified by CPE cpe:2.3:a:solarwinds:access_rights_manager:*:*:*:*:*:*:*:*)
Windows environments running SolarWinds ARM for Active Directory rights management

Discovery Timeline

2024-07-17 - CVE-2024-23467 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23467

Vulnerability Analysis

CVE-2024-23467 is a path traversal vulnerability in SolarWinds Access Rights Manager. The product fails to properly restrict pathname inputs that reference locations outside the intended working directory. An attacker with adjacent-network access can submit crafted requests containing directory traversal sequences to read files outside the application's designated file space. According to the SolarWinds advisory, the disclosed information can be leveraged by an unauthenticated user to perform remote code execution on the ARM host, elevating the impact from information disclosure to full system compromise.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified under [CWE-22]. ARM does not sufficiently canonicalize or validate user-supplied path components before using them in file system operations. Traversal sequences such as ../ are not stripped or rejected, allowing references to files outside the intended directory. Because the affected code path is reachable without authentication, exploitation requires only network reachability to the ARM service.

Attack Vector

An attacker must have access to a network adjacent to the ARM server to reach the vulnerable service endpoint. No authentication and no user interaction are required. The attacker sends a request containing a manipulated path parameter that resolves outside the expected directory. This yields file read primitives that can be chained to disclose credentials, configuration data, or binaries, and ultimately used to load or execute attacker-controlled code on the ARM host. The EPSS score for this CVE is 2.928% (85.784 percentile), indicating meaningful exploitation likelihood relative to the broader CVE population.

No public proof-of-concept or exploit code has been published for CVE-2024-23467 at the time of writing. See the SolarWinds ARM 2024.3 Release Notes for vendor-supplied technical details.

Detection Methods for CVE-2024-23467

Indicators of Compromise

Web or API requests to the ARM service containing traversal sequences such as ../, ..\, %2e%2e%2f, or %2e%2e%5c in URL paths or parameters.
Unexpected file read access on the ARM host targeting sensitive locations such as C:\Windows\System32\config\, ARM configuration files, or credential stores.
Unusual child processes spawned by the SolarWinds ARM service account, particularly cmd.exe, powershell.exe, rundll32.exe, or unsigned binaries.
Outbound network connections initiated by ARM processes to unfamiliar external hosts.

Detection Strategies

Inspect ARM application and IIS logs for URL-encoded and double-encoded traversal patterns targeting the ARM web components.
Alert on process lineage where the ARM service is the parent of interactive shells or scripting engines.
Correlate file access telemetry to flag reads of files outside the ARM installation directory by the ARM service account.
Monitor for creation of new files, scheduled tasks, or services on ARM servers following anomalous inbound requests.

Monitoring Recommendations

Enable and centralize logging from ARM, IIS, and Windows Event Logs on ARM servers, forwarding to a SIEM for analysis.
Baseline normal ARM traffic sources and alert on connections from network segments that should not reach the ARM host.
Track authentication and file-access anomalies on Active Directory objects managed by ARM, since ARM compromise can cascade into AD abuse.

How to Mitigate CVE-2024-23467

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later, which contains the vendor fix.
Restrict network access to the ARM server so it is only reachable from trusted administrative segments.
Review ARM logs and host telemetry for signs of prior exploitation, focusing on traversal patterns and anomalous process execution.
Rotate credentials, service account passwords, and API tokens stored on or accessible from the ARM host if compromise is suspected.

Patch Information

SolarWinds resolved CVE-2024-23467 in Access Rights Manager 2024.3. Refer to the SolarWinds ARM 2024.3 Release Notes for the full list of addressed issues and upgrade guidance. Apply the update in a maintenance window and verify the ARM version after installation.

Workarounds

Place the ARM server behind a firewall or VLAN that restricts access to only authorized administrator workstations and jump hosts.
Terminate the ARM service if patching cannot be performed immediately and the host is exposed to untrusted network segments.
Apply Windows host-based firewall rules to allow inbound connections to ARM ports only from a defined administrative allow-list.

bash

# Example Windows Firewall rule restricting ARM inbound access to a trusted admin subnet
New-NetFirewallRule -DisplayName "Restrict SolarWinds ARM Access" `
  -Direction Inbound `
  -Program "C:\Program Files\SolarWinds\ARM\ARM.Server.exe" `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow