CVE-2024-23468: SolarWinds ARM Path Traversal Vulnerability

CVE-2024-23468 Overview

CVE-2024-23468 is a directory traversal and information disclosure vulnerability in SolarWinds Access Rights Manager (ARM). The flaw allows an unauthenticated attacker on an adjacent network to perform arbitrary file deletion and access sensitive information stored on the underlying system. SolarWinds ARM is widely deployed to audit and manage access to Active Directory, file servers, and Microsoft 365 resources, making the affected component a high-value target. The weakness is categorized under CWE-22, Improper Limitation of a Pathname to a Restricted Directory. SolarWinds addressed the issue in the ARM 2024.3 release.

Critical Impact
Unauthenticated attackers on an adjacent network can delete arbitrary files and read sensitive data from ARM servers, disrupting identity governance operations.

Affected Products

SolarWinds Access Rights Manager versions prior to 2024.3
SolarWinds ARM Server components exposed on adjacent networks
Environments running ARM for Active Directory access governance

Discovery Timeline

2024-07-17 - CVE-2024-23468 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23468

Vulnerability Analysis

The vulnerability resides in a request-handling routine within SolarWinds Access Rights Manager that accepts file path input without sufficient canonicalization. An attacker can supply path traversal sequences such as ..\ or ../ to escape the intended working directory. Once outside the intended path scope, the attacker can reference arbitrary files on the ARM host. The flaw supports two distinct primitives: arbitrary file deletion and disclosure of sensitive file contents. Because the endpoint is reachable without authentication, no valid ARM credentials are required to trigger either primitive.

Exploitation requires network adjacency, meaning the attacker must reside on the same broadcast domain or a directly connected network segment. The impact combines high confidentiality loss, low integrity impact, and high availability impact. Deletion of ARM configuration files, database artifacts, or Windows system files can render the identity governance service inoperable.

Root Cause

The root cause is missing or incomplete validation of user-supplied path components before they are passed to file system APIs. The application concatenates attacker-controlled input into file paths and does not enforce that the resolved path remains within an allow-listed directory. This is a classic directory traversal defect tracked as CWE-22.

Attack Vector

An adjacent unauthenticated attacker sends a crafted request to an exposed ARM service endpoint. The request embeds traversal sequences in a parameter that the server later uses to construct a file path. The server resolves the path outside the intended directory and either returns file contents or performs a delete operation. See the SolarWinds ARM 2024.3 Release Notes for the vendor advisory. No public proof-of-concept is available at this time.

Detection Methods for CVE-2024-23468

Indicators of Compromise

Unexpected deletion of files under the ARM installation directory or Windows system directories on ARM servers
ARM service crashes or startup failures following inbound network activity from adjacent hosts
Web or application logs containing path traversal sequences such as ..%2f, ..\, or encoded variants targeting ARM endpoints
Anomalous file read operations initiated by the ARM service account against paths outside the ARM install directory

Detection Strategies

Inspect ARM application and IIS logs for HTTP requests containing traversal patterns aimed at ARM listener ports
Correlate file deletion events (Windows Event ID 4660 and 4663) on ARM hosts with inbound network sessions from non-management subnets
Alert on ARM service account accessing files outside its expected working directories

Monitoring Recommendations

Ingest ARM server Windows Security, Application, and IIS logs into a central SIEM for correlation
Baseline normal file system access patterns of the ARM service account and alert on deviations
Monitor network segments adjacent to ARM servers for unauthorized hosts and lateral scanning behavior

How to Mitigate CVE-2024-23468

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later as instructed in the vendor release notes
Inventory all ARM deployments and confirm patch status across production, staging, and disaster recovery environments
Restrict network access to ARM servers so that only trusted management hosts can reach ARM service ports
Review ARM host file system integrity for evidence of unauthorized deletion or access

Patch Information

SolarWinds resolved CVE-2024-23468 in Access Rights Manager 2024.3. Administrators should follow the upgrade procedure documented in the SolarWinds ARM 2024.3 Release Notes. Verify the installed version through the ARM console after the upgrade completes.

Workarounds

Place ARM servers behind a segmented management VLAN and enforce host-based firewall rules that restrict inbound access to authorized administrators
Disable or block adjacent-network access paths to ARM listener ports until the patch is applied
Enable file integrity monitoring on ARM installation directories to detect tampering during the remediation window

bash

# Example Windows Firewall rule to restrict ARM listener access to a management subnet
New-NetFirewallRule -DisplayName "Restrict ARM Access" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8443 `
  -RemoteAddress 10.10.50.0/24 `
  -Action Allow