CVE-2024-23474: SolarWinds Access Rights Manager Vulnerability

CVE-2024-23474 Overview

SolarWinds Access Rights Manager (ARM) contains an arbitrary file deletion and information disclosure vulnerability. The flaw allows an adjacent-network attacker without authentication to delete arbitrary files and read sensitive data from the affected system. Access Rights Manager is a widely deployed permissions and identity governance product used to monitor Active Directory and file server access across Windows environments. Exploitation impacts confidentiality, integrity, and availability of the host running ARM. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). SolarWinds addressed the issue in the ARM 2024.3 release.

Critical Impact
An unauthenticated adjacent-network attacker can delete arbitrary files and disclose sensitive information on servers running SolarWinds Access Rights Manager prior to version 2024.3.

Affected Products

SolarWinds Access Rights Manager versions prior to 2024.3
Deployments exposing ARM services to adjacent network segments
Windows hosts running the vulnerable ARM application services

Discovery Timeline

2024-07-17 - CVE-2024-23474 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-23474

Vulnerability Analysis

The vulnerability is a path traversal weakness (CWE-22) in SolarWinds Access Rights Manager. ARM fails to properly restrict pathnames supplied through an exposed service interface. An attacker on an adjacent network can craft requests containing traversal sequences to reach files outside intended directories. The flaw permits two distinct outcomes: deletion of arbitrary files on the host and disclosure of file contents the ARM service can read. Because ARM typically runs with elevated Windows service privileges, targeted files may include configuration data, logs, and directory-service metadata. Deleting service binaries, database files, or dependency libraries can render ARM inoperable and disrupt permission governance workflows across the enterprise.

Root Cause

ARM does not adequately sanitize or canonicalize file path parameters before performing filesystem operations. Input containing directory traversal characters such as ..\ is honored rather than rejected. The service invokes delete and read primitives against attacker-controlled paths without validating that the resolved path stays within an allowed root.

Attack Vector

Exploitation requires network access to the ARM host on the same broadcast domain or adjacent segment where the service listens. No authentication and no user interaction are required. An attacker sends malformed protocol messages that embed traversal sequences in a file path field. The server resolves the path, then performs the requested delete or read operation, returning file contents or destroying the target file. Chained exploitation can escalate impact by removing security controls and then leveraging disclosed credentials or configuration data for follow-on access.

No public proof-of-concept or in-the-wild exploitation has been confirmed. Detailed exploitation mechanics are not disclosed in the vendor advisory. Refer to the SolarWinds ARM 2024.3 Release Notes for vendor guidance.

Detection Methods for CVE-2024-23474

Indicators of Compromise

Unexpected deletion of files in ARM installation, configuration, or database directories
ARM service crashes, restart loops, or missing binaries following adjacent-network traffic
Anomalous inbound connections to ARM service ports from workstations or non-administrative hosts
Windows Security event log entries showing SYSTEM-level file operations initiated by the ARM service against unusual paths

Detection Strategies

Enable filesystem auditing on the ARM installation directory and log any deletion or read events tied to the ARM service account
Alert on ARM process activity that touches paths containing traversal sequences such as ..\ or absolute paths outside the ARM working directory
Baseline normal network peers that communicate with the ARM host and flag new sources issuing binary or RPC-style traffic

Monitoring Recommendations

Forward Windows Security, System, and ARM application logs to a centralized SIEM for correlation
Monitor for gaps or truncation in ARM database and log files that could indicate tampering
Track service availability metrics for ARM and alert on unplanned stops or repeated restarts

How to Mitigate CVE-2024-23474

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later, which contains the vendor fix
Restrict network access to the ARM host so only administrative management subnets can reach ARM service ports
Review ARM installation directories, backups, and audit logs for signs of file deletion or unauthorized access
Rotate credentials and service account secrets stored on the ARM host if compromise is suspected

Patch Information

SolarWinds released the fix in Access Rights Manager 2024.3. Administrators should review the SolarWinds ARM 2024.3 Release Notes and apply the upgrade following the vendor's documented procedure. Validate ARM database backups before upgrading and test the upgrade in a staging environment where feasible.

Workarounds

Isolate the ARM server on a dedicated management VLAN with strict ingress access control lists
Block adjacent-network access to ARM service ports from user workstations using host-based firewall rules
Enforce least-privilege on the ARM service account and remove unnecessary filesystem permissions where operationally viable

bash

# Example Windows Firewall rule restricting ARM inbound traffic to a management subnet
New-NetFirewallRule -DisplayName "Restrict ARM Inbound" `
  -Direction Inbound `
  -Program "C:\Program Files\SolarWinds\ARM\ARM.exe" `
  -RemoteAddress 10.10.50.0/24 `
  -Action Allow