CVE-2024-23475: SolarWinds ARM Path Traversal Vulnerability

CVE-2024-23475 Overview

CVE-2024-23475 is a directory traversal and information disclosure vulnerability in SolarWinds Access Rights Manager (ARM). The flaw allows an unauthenticated attacker on an adjacent network to perform arbitrary file deletion and read sensitive files from the host system. The weakness is tracked as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. SolarWinds addressed the issue in the ARM 2024.3 release. The vulnerability affects confidentiality, integrity, and availability of the ARM server and any data it stores or manages.

Critical Impact
Unauthenticated attackers on adjacent networks can traverse the filesystem to delete arbitrary files and leak sensitive information, potentially disrupting identity governance operations and exposing credentials.

Affected Products

SolarWinds Access Rights Manager (ARM) versions prior to 2024.3
Deployments exposing ARM services to internal or adjacent network segments
Windows Server hosts running vulnerable ARM installations

Discovery Timeline

2024-07-17 - CVE-2024-23475 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23475

Vulnerability Analysis

SolarWinds Access Rights Manager centralizes permission auditing and identity governance across Active Directory, file servers, and Microsoft 365. The vulnerability exists in an ARM service that processes file path inputs without adequate validation. An attacker on an adjacent network can send crafted requests containing path traversal sequences to reach files outside the intended directory. The service both reads and deletes files based on the attacker-supplied path, producing a combined information disclosure and destructive file operation primitive.

Because ARM often runs with elevated privileges to enumerate directory rights, the process has broad access to sensitive files. Leaked material can include configuration data, credentials, scan results, and audit records. Deleted files can degrade ARM functionality or destroy audit evidence.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected component accepts user-controlled path fragments and joins them to a base directory without canonicalization or whitelist validation. Sequences such as ..\ or absolute paths are not stripped, so the resolved path escapes the intended sandbox.

Attack Vector

The attack vector is Adjacent Network with no privileges and no user interaction required. An attacker with access to the same broadcast domain, VPN segment, or internal network as the ARM host can reach the vulnerable service directly. The attacker sends crafted requests containing traversal payloads targeting arbitrary paths on the host filesystem. Successful exploitation yields file contents in the service response and enables arbitrary file deletion on the ARM server.

No public proof-of-concept is currently listed, and the vulnerability is not tracked in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability places it in the upper range of published CVEs, indicating meaningful exploitation likelihood.

Detection Methods for CVE-2024-23475

Indicators of Compromise

Requests to ARM service endpoints containing ..\, ../, or URL-encoded traversal sequences such as %2e%2e%5c
Unexpected deletion of files under the ARM installation directory or Windows system directories
ARM service logs showing failed file reads outside the standard working paths
Outbound egress of ARM configuration files or archived scan data to unfamiliar hosts

Detection Strategies

Inspect ARM application and IIS-style access logs for path traversal patterns in query strings and POST bodies
Correlate file system audit events (Event ID 4663) on the ARM host with process activity from ARM service accounts
Alert on anomalous file delete operations performed by the ARM service process outside its normal directories
Baseline the network traffic profile of ARM servers and flag unusual read volumes from adjacent hosts

Monitoring Recommendations

Enable Windows object access auditing on the ARM installation directory and on directories containing credentials
Forward ARM host telemetry (process, file, and network events) to a centralized analytics platform for retention and correlation
Monitor for creation of new local administrator accounts or scheduled tasks on ARM servers following suspicious network activity
Track ARM version inventory continuously to identify unpatched instances

How to Mitigate CVE-2024-23475

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later on all servers
Restrict network reachability to ARM services so only trusted administrative subnets can connect
Review ARM host file integrity and audit logs for evidence of arbitrary file access or deletion
Rotate credentials stored on or accessible to the ARM host if compromise is suspected

Patch Information

SolarWinds resolved the vulnerability in Access Rights Manager 2024.3. Refer to the SolarWinds ARM 2024.3 Release Notes for the full list of security fixes and upgrade instructions. Apply the update through the standard ARM installer after backing up the ARM database and configuration.

Workarounds

Place ARM servers behind a management-only VLAN with strict firewall ACLs limiting inbound access to authorized administrators
Disable or block adjacent-network exposure of ARM service ports at the host firewall until patching is complete
Run ARM service accounts with the minimum privileges required to perform scans and delegated tasks
Take verified backups of ARM configuration and databases so destructive file operations can be reversed

bash

# Example Windows Firewall rule restricting ARM service to a management subnet
New-NetFirewallRule -DisplayName "ARM-Restrict-Inbound" `
  -Direction Inbound `
  -Program "C:\Program Files\SolarWinds\ARM\ARM.Server.exe" `
  -Action Allow `
  -RemoteAddress 10.10.50.0/24

New-NetFirewallRule -DisplayName "ARM-Block-Other" `
  -Direction Inbound `
  -Program "C:\Program Files\SolarWinds\ARM\ARM.Server.exe" `
  -Action Block