CVE-2024-28992: SolarWinds ARM Path Traversal Vulnerability

CVE-2024-28992 Overview

CVE-2024-28992 affects SolarWinds Access Rights Manager (ARM), an enterprise tool for managing and auditing access to Active Directory, file servers, and Microsoft 365 resources. The vulnerability combines a directory traversal weakness [CWE-22] with an authentication issue [CWE-287]. An unauthenticated attacker on an adjacent network can traverse directories, delete arbitrary files, and leak sensitive information from the ARM host. Because ARM stores privileged access data, information disclosure here can expose credentials, group memberships, and permission mappings that support follow-on identity attacks.

Critical Impact
Unauthenticated attackers on an adjacent network can delete arbitrary files and read sensitive data from SolarWinds Access Rights Manager, undermining the integrity of access governance data.

Affected Products

SolarWinds Access Rights Manager (ARM) versions prior to 2024.3
Deployments exposing the ARM service to adjacent network segments
Environments where ARM manages Active Directory, file server, or Microsoft 365 access

Discovery Timeline

2024-07-17 - CVE-2024-28992 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28992

Vulnerability Analysis

The flaw resides in the SolarWinds Access Rights Manager service handling of file-path inputs from network requests. The service accepts requests without proper authentication and does not sanitize path parameters. An attacker on the adjacent network can supply crafted path sequences that escape the intended directory. This enables reading files outside the application scope and deleting arbitrary files that the ARM service account can access.

Exploitation requires no user interaction and no credentials. The impact combines high confidentiality loss, low integrity loss, and high availability loss. Availability degrades when deletion targets configuration, database, or dependent binaries. Confidentiality loss can expose ARM configuration files, cached credentials, and access-rights inventories. Because ARM typically runs with elevated privileges to enumerate directory objects, the deletion primitive can also disrupt the server itself.

Root Cause

Two weaknesses interact. First, the affected endpoint lacks authentication enforcement [CWE-287], allowing anonymous callers on the adjacent network to reach sensitive functionality. Second, the endpoint constructs file paths from attacker-controlled input without canonicalization or allowlist validation [CWE-22]. Sequences such as ..\ traverse outside the intended base directory. The combination converts a request-parsing bug into an unauthenticated file read and delete primitive.

Attack Vector

The attack vector is Adjacent Network. An attacker must have logical access to the same broadcast domain, VPN segment, or routed enclave as the ARM host. From that position the attacker sends a crafted request to the vulnerable ARM service. The request contains a path parameter with traversal sequences pointing at a file outside the ARM installation directory. The service reads or deletes the target file and returns the response or triggers the destructive action. See the SolarWinds ARM Release Notes for vendor-specific details.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no sanctioned proof-of-concept has been released.

Detection Methods for CVE-2024-28992

Indicators of Compromise

ARM service log entries containing path traversal sequences such as ..\, ..%2f, or %2e%2e%5c in request parameters
Unexpected file deletions in ARM installation, log, or configuration directories
Anonymous or unauthenticated requests to ARM service endpoints from hosts that do not normally query ARM
Windows Security event ID 4663 showing the ARM service account accessing files outside its normal working set

Detection Strategies

Alert on HTTP or RPC requests to ARM listeners containing URL-encoded or raw traversal sequences
Correlate ARM service process file-delete operations with the originating network connection to identify unauthenticated callers
Baseline the set of files the ARM service reads and writes, then flag deviations targeting system directories or credential stores

Monitoring Recommendations

Enable Windows object access auditing on the ARM installation directory and adjacent sensitive paths
Forward ARM application logs and Windows Security logs to a centralized analytics platform for retention and search
Monitor for ARM service restarts or crashes that follow anomalous inbound network activity
Track access to ARM database files and configuration stores that hold cached credentials or connection strings

How to Mitigate CVE-2024-28992

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later, which contains the vendor fix
Restrict network reachability of ARM management ports to a dedicated administrative VLAN
Rotate credentials that ARM caches or uses to enumerate directory services if compromise is suspected
Review ARM installation and log directories for unexpected deletions or modifications since July 2024

Patch Information

SolarWinds resolved the directory traversal and information disclosure issue in Access Rights Manager 2024.3. Apply the update from the vendor download portal and validate service startup after installation. Full patch notes are available in the SolarWinds ARM 2024.3 Release Notes.

Workarounds

Segment the ARM server so only authorized administrator workstations can reach its service ports
Apply host-based firewall rules that block ARM listener ports from general user subnets
Run the ARM service under a least-privilege account that lacks write access to operating system directories
Increase logging verbosity on ARM to capture request parameters for forensic review until the patch is applied

bash

# Example Windows firewall restriction limiting ARM listener to admin subnet
New-NetFirewallRule -DisplayName "ARM-Admin-Only" -Direction Inbound `
  -Protocol TCP -LocalPort 8081,8082 `
  -RemoteAddress 10.20.30.0/24 -Action Allow

New-NetFirewallRule -DisplayName "ARM-Block-Other" -Direction Inbound `
  -Protocol TCP -LocalPort 8081,8082 `
  -Action Block