CVE-2024-28073: SolarWinds Serv-U Path Traversal Flaw

CVE-2024-28073 Overview

CVE-2024-28073 is a directory traversal vulnerability in SolarWinds Serv-U that can lead to remote code execution. The flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Exploitation requires an authenticated user with a highly privileged account on the Serv-U instance.

SolarWinds Serv-U is a managed file transfer server deployed by enterprises to exchange files over FTP, FTPS, SFTP, and HTTPS. Successful exploitation gives attackers the ability to traverse outside intended directory boundaries and execute arbitrary code on the underlying host.

Critical Impact
An authenticated attacker with high privileges can execute arbitrary code on the Serv-U host through directory traversal, compromising the file transfer server and any data it processes.

Affected Products

SolarWinds Serv-U (all versions prior to the vendor-supplied fix)
Serv-U File Server deployments on Windows and Linux hosts
Serv-U Managed File Transfer Server

Discovery Timeline

2024-04-17 - CVE-2024-28073 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28073

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied path input in SolarWinds Serv-U. An authenticated attacker with high privileges can inject directory traversal sequences into a request handled by the server. The server then resolves the manipulated path outside the intended restricted directory.

Because Serv-U runs with service-level permissions on the host, traversal to writable or executable locations enables remote code execution. The attack is delivered over the network and does not require user interaction. The confidentiality, integrity, and availability of the host are all at risk after successful exploitation.

Root Cause

The root cause is insufficient sanitization of pathname components before file system operations, classified as [CWE-22]. Serv-U does not adequately reject .. sequences, encoded traversal payloads, or absolute path substitutions supplied through privileged administrative interfaces. This design flaw allows a caller to escape the intended file transfer sandbox.

Attack Vector

An attacker must first obtain a highly privileged Serv-U account, such as a system administrator role. From an authenticated session, the attacker submits crafted requests containing traversal payloads targeting sensitive file system locations. Writing to service startup directories, script paths, or configuration files converts the directory traversal into code execution. The attack is network-reachable wherever the Serv-U administrative interface is exposed.

No public proof-of-concept exploit code is available for this CVE. Refer to the SolarWinds Security Advisory CVE-2024-28073 for vendor-specific technical detail.

Detection Methods for CVE-2024-28073

Indicators of Compromise

Serv-U log entries containing path traversal sequences such as ../, ..\, or URL-encoded equivalents like %2e%2e%2f in file operation requests
Unexpected files written outside of the configured Serv-U user root directories, particularly in system, script, or service paths
Administrative sessions originating from unusual source IP addresses or performing atypical file operations
New or modified executables, scripts, or scheduled tasks on the Serv-U host that correlate with administrator activity

Detection Strategies

Correlate authenticated administrator activity in Serv-U with file system write events on the host to surface out-of-sandbox writes
Monitor Serv-U HTTP and API request logs for traversal patterns and reject-and-alert on encoded variants
Baseline privileged Serv-U account behavior and alert on deviations such as new administrator logins from foreign geographies
Hunt for child processes spawned by the Serv-U service process (Serv-U.exe on Windows), which should rarely occur during normal operation

Monitoring Recommendations

Forward Serv-U application and audit logs to a centralized logging platform and retain them for incident response
Enable file integrity monitoring on the Serv-U installation directory and any writable directories reachable by the service account
Alert on process creation events where the Serv-U service is the parent process
Track authentication events for administrator-tier Serv-U accounts and enforce alerting on credential reuse or brute-force attempts

How to Mitigate CVE-2024-28073

Immediate Actions Required

Apply the SolarWinds Serv-U security update referenced in the SolarWinds Security Advisory CVE-2024-28073
Audit all Serv-U accounts and remove or downgrade unnecessary administrator-level privileges
Restrict network exposure of the Serv-U administrative interface to trusted management networks or VPN only
Rotate credentials for privileged Serv-U accounts and enforce multi-factor authentication where supported

Patch Information

SolarWinds has published a security advisory and fixed build for this vulnerability. Administrators should upgrade Serv-U to the version specified in the SolarWinds Security Advisory CVE-2024-28073. Verify the installed version after patching and confirm that the vulnerable code path is no longer reachable.

Workarounds

Limit administrator access to Serv-U to a minimal set of named accounts protected by strong authentication
Place the Serv-U administrative interface behind a reverse proxy or firewall rule that restricts access by source IP
Run the Serv-U service under a low-privilege account that cannot write to sensitive system locations
Increase audit logging verbosity on Serv-U to capture full request paths for privileged operations

bash

# Example firewall restriction limiting Serv-U admin interface to a management subnet
# Replace 10.0.10.0/24 with your management network and 43958 with your admin port
iptables -A INPUT -p tcp --dport 43958 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 43958 -j DROP