CVE-2024-23473: SolarWinds ARM Auth Bypass Vulnerability

CVE-2024-23473 Overview

A critical hardcoded credential authentication bypass vulnerability has been discovered in SolarWinds Access Rights Manager (ARM). This security flaw allows unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to the RabbitMQ management console, potentially compromising the entire access rights management infrastructure.

The vulnerability stems from hard-coded credentials embedded within the application (CWE-798), a severe security oversight that enables attackers to authenticate to sensitive management interfaces without valid user credentials. Given SolarWinds' prominent role in enterprise IT infrastructure management, this vulnerability poses significant risk to organizations relying on ARM for access governance.

Critical Impact

Unauthenticated remote attackers can exploit hard-coded credentials to access the RabbitMQ management console, potentially leading to complete system compromise, data exfiltration, and lateral movement within enterprise networks.

Affected Products

• SolarWinds Access Rights Manager (versions prior to 2023.2.4)

Discovery Timeline

• 2024-05-14 - CVE-2024-23473 published to NVD
• 2025-02-10 - Last updated in NVD database

This vulnerability was discovered and responsibly disclosed through the Trend Micro Zero Day Initiative (ZDI) coordinated disclosure program with SolarWinds.

Technical Details for CVE-2024-23473

Vulnerability Analysis

This vulnerability represents a fundamental security design flaw where authentication credentials are embedded directly into the application code or configuration files. The hard-coded credentials provide direct access to the RabbitMQ management console, a critical component used for message queuing and inter-process communication within the Access Rights Manager architecture.

The attack surface is particularly concerning because exploitation requires no authentication, no user interaction, and can be performed remotely over the network. An attacker with network access to an affected ARM installation can leverage these embedded credentials to authenticate to the RabbitMQ management interface, gaining the ability to monitor message queues, manipulate message flows, and potentially inject malicious commands.

Root Cause

The root cause of CVE-2024-23473 is the use of hard-coded credentials (CWE-798) within the SolarWinds Access Rights Manager application. During development, static authentication credentials were embedded in the application for RabbitMQ management console access. These credentials were not properly randomized, externalized, or secured during deployment, leaving them accessible to anyone who can analyze the application or its configuration files.

Hard-coded credentials represent a critical security anti-pattern because they cannot be easily changed without modifying the application itself, and once discovered, they provide persistent access until the affected software is updated.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to have network connectivity to the SolarWinds Access Rights Manager installation. The exploitation flow involves:

1. The attacker identifies a SolarWinds Access Rights Manager instance on the network
2. The attacker locates the RabbitMQ management console endpoint
3. Using the hard-coded credentials extracted from the application, the attacker authenticates to the management console
4. Once authenticated, the attacker gains full access to RabbitMQ functionality, including message queue management, user administration, and potentially the ability to execute commands within the ARM infrastructure

This vulnerability can be exploited without any user interaction and does not require prior authentication to the target system. The hard-coded credentials remain consistent across installations, meaning a single discovery of these credentials can enable attacks against all unpatched ARM deployments.

Detection Methods for CVE-2024-23473

Indicators of Compromise

• Unexpected authentication events to the RabbitMQ management console from external or unauthorized IP addresses
• Multiple successful login attempts to RabbitMQ using the same credential set from different source IPs
• Unusual message queue operations or administrative actions within RabbitMQ logs
• Network traffic to RabbitMQ management ports (typically 15672) from untrusted network segments

Detection Strategies

• Monitor authentication logs for the RabbitMQ management console and alert on successful logins from unexpected sources
• Implement network intrusion detection rules to identify connection attempts to RabbitMQ management interfaces from external networks
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious processes interacting with ARM components
• Review audit logs for administrative changes to message queues or RabbitMQ configuration

Monitoring Recommendations

• Enable verbose logging on the SolarWinds Access Rights Manager and RabbitMQ components
• Configure SIEM alerts for authentication anomalies related to RabbitMQ services
• Implement network segmentation monitoring to detect unauthorized access attempts to management interfaces
• Establish baseline behavior for RabbitMQ management console access and alert on deviations

How to Mitigate CVE-2024-23473

Immediate Actions Required

• Upgrade SolarWinds Access Rights Manager to version 2023.2.4 or later immediately
• Restrict network access to the RabbitMQ management console to trusted administrative networks only
• Review authentication logs for any signs of exploitation prior to patching
• Implement network segmentation to isolate ARM infrastructure from untrusted network segments

Patch Information

SolarWinds has released a security patch addressing CVE-2024-23473 in Access Rights Manager version 2023.2.4. Organizations should apply this update as soon as possible to remediate the vulnerability. The patch addresses the hard-coded credential issue by implementing proper credential management practices.

For detailed patch information and download links, refer to the SolarWinds ARM 2023.2.4 Release Notes and the SolarWinds Security Advisory for CVE-2024-23473.

Workarounds

• Implement strict firewall rules to block external access to RabbitMQ management ports (default: 15672)
• Use network access control lists (ACLs) to restrict management console access to authorized administrator workstations only
• Deploy a reverse proxy with additional authentication layers in front of the RabbitMQ management interface as a defense-in-depth measure
• Consider temporarily disabling the RabbitMQ management console if not required for operations until patching is complete

# Example firewall rule to restrict RabbitMQ management console access
# Allow only trusted admin network (192.168.10.0/24) to access management port
iptables -A INPUT -p tcp --dport 15672 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 15672 -j DROP