CVE-2024-28991: SolarWinds Access Rights Manager RCE Flaw

CVE-2024-28991 Overview

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), indicating that the application processes serialized data without proper validation, enabling attackers to execute arbitrary code on the target system.

Critical Impact

Authenticated attackers with adjacent network access can achieve remote code execution on SolarWinds Access Rights Manager servers, potentially compromising the entire access rights management infrastructure and gaining unauthorized control over managed systems and user permissions.

Affected Products

• SolarWinds Access Rights Manager (versions prior to 2024.3.1)
• solarwinds:access_rights_manager (all vulnerable versions)

Discovery Timeline

• 2024-09-12 - CVE-2024-28991 published to NVD
• 2025-02-26 - Last updated in NVD database

Technical Details for CVE-2024-28991

Vulnerability Analysis

This vulnerability stems from insecure deserialization within SolarWinds Access Rights Manager. The application fails to properly validate or sanitize serialized data before processing, allowing an authenticated attacker to craft malicious serialized objects that execute arbitrary code when deserialized by the vulnerable service.

The attack requires authentication and adjacent network access, meaning the attacker must have valid credentials and be on the same network segment as the target ARM server. However, once these conditions are met, the attacker can achieve complete compromise of the system's confidentiality, integrity, and availability.

Root Cause

The root cause of CVE-2024-28991 is improper handling of serialized data within the Access Rights Manager application. The service accepts serialized objects from authenticated users without implementing adequate validation or type restrictions. This allows attackers to inject malicious object graphs that, when deserialized, trigger the execution of arbitrary code within the context of the ARM service.

Deserialization vulnerabilities occur when applications blindly trust incoming serialized data. In object-oriented languages, the deserialization process can trigger class constructors, finalizers, or other methods that can be chained together in unexpected ways to achieve code execution—commonly known as "gadget chains."

Attack Vector

The attack vector for CVE-2024-28991 requires adjacent network access, meaning the attacker must be on the same local network or network segment as the vulnerable SolarWinds ARM installation. Additionally, the attacker needs valid credentials to authenticate to the service before exploiting the deserialization flaw.

Once authenticated, the attacker can submit specially crafted serialized payloads to the vulnerable endpoint. The ARM service deserializes these payloads without proper validation, triggering the execution of attacker-controlled code. This can lead to complete system compromise, including the ability to read or modify access rights data, pivot to other systems, or establish persistent access.

The vulnerability does not require user interaction and can be exploited with low attack complexity once the authentication and network requirements are satisfied. For detailed technical information about the vulnerability mechanism, refer to the SolarWinds Security Advisory.

Detection Methods for CVE-2024-28991

Indicators of Compromise

• Unusual or malformed serialized data in ARM service logs or network traffic
• Unexpected process spawning from the SolarWinds ARM service process
• Anomalous outbound network connections from the ARM server
• Authentication events followed by unusual service behavior or errors
• Creation of unexpected files or modifications to system configurations by the ARM process

Detection Strategies

• Monitor ARM service processes for child process creation that deviates from normal operational patterns
• Implement network traffic analysis to detect unusual serialized payloads being sent to ARM endpoints
• Deploy endpoint detection and response (EDR) solutions to identify code execution anomalies
• Enable verbose logging on ARM servers and correlate authentication events with subsequent service behavior

Monitoring Recommendations

• Configure SIEM rules to alert on suspicious ARM service activity patterns
• Establish baseline behavior for ARM services and alert on deviations
• Monitor for lateral movement attempts originating from ARM servers
• Implement network segmentation monitoring to detect unauthorized adjacent network access attempts

How to Mitigate CVE-2024-28991

Immediate Actions Required

• Update SolarWinds Access Rights Manager to version 2024.3.1 or later immediately
• Review ARM server logs for any signs of exploitation attempts
• Audit user accounts with access to ARM and remove unnecessary privileges
• Implement network segmentation to limit adjacent network access to ARM servers

Patch Information

SolarWinds has released a security update that addresses this vulnerability. Organizations should upgrade to Access Rights Manager version 2024.3.1 or later. The patch information and release notes are available in the SolarWinds ARM Release Notes. The official security advisory with remediation guidance is available at the SolarWinds Security Advisory.

Workarounds

• Restrict network access to ARM servers using firewall rules to limit adjacent network exposure
• Implement strict authentication controls and multi-factor authentication for ARM access
• Monitor and audit all authenticated sessions to ARM services
• Consider temporarily isolating ARM servers from untrusted network segments until patching is complete
• Implement application allowlisting on ARM servers to prevent unauthorized code execution

# Network segmentation example - restrict ARM access to management VLAN only
# Adjust firewall rules to limit adjacent network access
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP