CVE-2024-28990: SolarWinds ARM Auth Bypass Vulnerability

CVE-2024-28990 Overview

SolarWinds Access Rights Manager (ARM) contains a hard-coded credential authentication bypass vulnerability in its RabbitMQ management console integration. An attacker on an adjacent network can use the embedded static credentials to authenticate to the RabbitMQ management interface without authorization. Once authenticated, the attacker gains administrative control over message broker operations that underpin ARM's internal communications. SolarWinds credited Trend Micro's Zero Day Initiative (ZDI) for coordinated disclosure. The flaw is tracked under CWE-798: Use of Hard-coded Credentials and is addressed in SolarWinds ARM 2024.3.1.

Critical Impact
Adjacent-network attackers can bypass authentication using embedded credentials to gain full access to the RabbitMQ management console used by SolarWinds ARM.

Affected Products

SolarWinds Access Rights Manager (ARM) versions prior to 2024.3.1
SolarWinds ARM deployments exposing the RabbitMQ management console to adjacent networks
Environments integrating ARM with Active Directory rights auditing workflows

Discovery Timeline

2024-09-12 - CVE-2024-28990 published to the National Vulnerability Database
2024-09-12 - SolarWinds releases advisory and ARM 2024.3.1 patch
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28990

Vulnerability Analysis

SolarWinds ARM ships with static credentials embedded in the product that grant access to the bundled RabbitMQ management console. RabbitMQ is the message broker ARM uses to coordinate collection and processing tasks between services. Because the credentials are compiled into the product distribution, every installation shares the same secret. An attacker who reaches the management port on an adjacent network segment can authenticate as a privileged RabbitMQ user without any interaction with ARM's application-layer authentication.

Once authenticated to the management console, the attacker can enumerate queues, read or publish messages, reconfigure exchanges, and manipulate virtual hosts. This position allows tampering with rights-management data in transit and can be leveraged to influence ARM operations that rely on trusted broker output. The vulnerability is classified under CWE-798.

Root Cause

The root cause is the inclusion of hard-coded RabbitMQ credentials in the ARM distribution. Static, non-rotatable secrets violate least-privilege and secret-management principles. Because the credentials cannot be changed by administrators without vendor intervention, exposure of any installation image effectively exposes all deployments.

Attack Vector

Exploitation requires network reachability to the RabbitMQ management interface bound to the ARM host. The attack vector is adjacent-network, meaning the attacker must share a broadcast or logically adjacent segment with the target. No user interaction or prior authentication to ARM is required. See the SolarWinds Security Advisory CVE-2024-28990 for vendor-supplied details.

Detection Methods for CVE-2024-28990

Indicators of Compromise

Authentication events on the RabbitMQ management console (default TCP 15672) originating from unexpected hosts or subnets.
Unusual queue, exchange, or virtual host creation, deletion, or permission modifications logged by RabbitMQ.
New AMQP connections to the ARM broker from workstations or hosts that do not run ARM components.
HTTP requests to /api/ endpoints on the RabbitMQ management interface from non-administrative sources.

Detection Strategies

Enable RabbitMQ audit logging and forward events to a centralized SIEM for correlation with ARM host activity.
Baseline expected connections to ports 5672 and 15672 on ARM servers and alert on deviations.
Inspect ARM server access logs for management console usage outside documented maintenance windows.
Correlate RabbitMQ authentication events with the source host inventory to identify unauthorized clients.

Monitoring Recommendations

Deploy network sensors on segments adjacent to ARM servers to capture RabbitMQ management traffic.
Monitor for lateral movement toward the ARM host from user VLANs, jump hosts, and administrative workstations.
Alert on process and service anomalies on the ARM server, including unexpected child processes of RabbitMQ services.

How to Mitigate CVE-2024-28990

Immediate Actions Required

Upgrade SolarWinds ARM to version 2024.3.1 or later as instructed in the ARM 2024.3.1 Release Notes.
Restrict network access to the RabbitMQ management port (15672) and AMQP port (5672) using host firewalls or network ACLs.
Audit RabbitMQ logs for prior authentication events from unexpected sources.
Inventory all ARM installations and confirm patch status through configuration management.

Patch Information

SolarWinds addressed the hard-coded credential issue in ARM 2024.3.1. The vendor advisory is published at SolarWinds Security Advisory CVE-2024-28990. Administrators should apply the patch, restart ARM services, and validate that RabbitMQ credentials have been rotated as part of the upgrade.

Workarounds

Isolate the ARM host on a management VLAN accessible only to administrators until patching is complete.
Block inbound access to RabbitMQ management and AMQP ports from all non-ARM sources using host-based firewall rules.
Disable the RabbitMQ management plugin on the ARM server if it is not required for operations.

bash

# Example: restrict RabbitMQ management port on the ARM host (Windows)
netsh advfirewall firewall add rule name="Block RabbitMQ Mgmt" ^
  dir=in action=block protocol=TCP localport=15672
netsh advfirewall firewall add rule name="Block RabbitMQ AMQP" ^
  dir=in action=block protocol=TCP localport=5672