CVE-2024-28993: SolarWinds Access Rights Manager Path Traversal

CVE-2024-28993 Overview

CVE-2024-28993 is a directory traversal and information disclosure vulnerability in SolarWinds Access Rights Manager (ARM). The flaw allows an unauthenticated attacker on an adjacent network to perform arbitrary file deletion and access sensitive information stored on the host. The weakness is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

SolarWinds addressed the issue in ARM 2024.3. Administrators running earlier versions should treat this as a priority patch because ARM manages access rights across Active Directory, file servers, and SharePoint environments.

Critical Impact
An unauthenticated attacker with adjacent network access can traverse the file system to read sensitive files and delete arbitrary files, compromising confidentiality and availability of the ARM host.

Affected Products

SolarWinds Access Rights Manager versions prior to 2024.3
Deployments integrated with Active Directory, file servers, and SharePoint
Windows Server hosts running vulnerable ARM services

Discovery Timeline

2024-07-17 - CVE-2024-28993 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28993

Vulnerability Analysis

CVE-2024-28993 is a directory traversal weakness in SolarWinds Access Rights Manager. The application accepts file path input from a network-exposed service without correctly restricting the path to an intended directory. An attacker can supply crafted path sequences such as ../ traversals to reference files outside the expected working directory.

Because the flaw does not require authentication and can be triggered from an adjacent network position, an attacker who reaches the ARM service can read sensitive configuration data and delete files that the ARM service account has permission to modify. Impacted files can include ARM configuration, logs, and integration artifacts tied to the identity data ARM manages.

The combination of information disclosure and arbitrary file deletion increases the operational risk. Deleting service dependencies or supporting files can disrupt ARM operations and downstream identity workflows.

Root Cause

The root cause is insufficient input validation on file path parameters processed by the ARM service. The code fails to canonicalize user-supplied paths and does not enforce a restricted base directory before performing file operations. This maps directly to CWE-22.

Attack Vector

Exploitation requires network access adjacent to the ARM host, such as a shared broadcast domain or an internal network segment. No credentials or user interaction are needed. The attacker sends crafted requests containing traversal sequences to the vulnerable ARM endpoint, then either reads returned file contents or triggers a delete operation against a targeted path.

No verified public exploit code or proof-of-concept has been published at this time. Refer to the SolarWinds ARM 2024.3 Release Notes for vendor guidance.

Detection Methods for CVE-2024-28993

Indicators of Compromise

Requests to ARM service endpoints containing path traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f
Unexpected deletion of files under the ARM installation directory or referenced configuration paths
Access to sensitive files by the ARM service account outside normal operational directories
Anomalous inbound connections to ARM management ports from non-administrative hosts on the same network segment

Detection Strategies

Review ARM application and Windows Security event logs for file deletion events tied to the ARM service account with unusual target paths
Inspect network traffic to ARM listeners for traversal patterns in request payloads and URIs
Correlate ARM service crashes or configuration errors with prior file access events to identify possible exploitation

Monitoring Recommendations

Enable file system auditing on the ARM installation directory and adjacent sensitive paths
Forward ARM host logs and network telemetry to a centralized analytics platform for correlation
Alert on any unauthenticated access attempts to ARM APIs from unexpected source hosts

How to Mitigate CVE-2024-28993

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later as documented in the vendor release notes
Restrict network access to ARM management interfaces to trusted administrative subnets only
Rotate credentials and API tokens stored on ARM hosts if compromise is suspected
Review file system audit logs for evidence of arbitrary reads or deletions prior to patching

Patch Information

SolarWinds released a fix in Access Rights Manager 2024.3. Full details, including upgrade procedures and downloads, are available in the SolarWinds ARM 2024.3 Release Notes.

Workarounds

Place ARM hosts behind network segmentation controls that block adjacent-network access from non-administrative systems
Apply host-based firewall rules to restrict inbound connections to ARM service ports
Enforce least privilege on the ARM service account so that deletable file scope is minimized until patching completes

bash

# Example Windows firewall rule to restrict ARM management access
# Replace <ARM_PORT> with the ARM service port and <ADMIN_SUBNET> with your admin CIDR
New-NetFirewallRule -DisplayName "Restrict ARM Mgmt" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort <ARM_PORT> `
  -RemoteAddress <ADMIN_SUBNET> `
  -Action Allow

New-NetFirewallRule -DisplayName "Block ARM Mgmt Default" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort <ARM_PORT> `
  -Action Block