CVE-2024-28995: SolarWinds Serv-U Path Traversal Flaw

CVE-2024-28995 Overview

SolarWinds Serv-U was susceptible to a directory traversal vulnerability that would allow access to read sensitive files on the host machine. This vulnerability poses a significant risk of sensitive data exposure as it can be exploited over the network without authentication or user interaction.

Critical Impact

This vulnerability could be leveraged by an attacker to access confidential files and information stored on the affected system.

Affected Products

• SolarWinds Serv-U
• SolarWinds Serv-U 15.4.2
• SolarWinds Serv-U 15.4.2 Hotfix 1

Discovery Timeline

• 2024-06-06 - CVE CVE-2024-28995 published to NVD
• 2025-10-27 - Last updated in NVD database

Technical Details for CVE-2024-28995

Vulnerability Analysis

This directory traversal vulnerability exploits flaws in the path handling of the SolarWinds Serv-U application, allowing attackers to craft paths that escape intended directory constraints.

Root Cause

The root cause is improper validation of user-supplied input, leading to path traversal. This allows attackers to access files and directories outside the prescribed paths.

Attack Vector

Network

# Example exploitation code (sanitized)
GET /../../../../etc/passwd HTTP/1.1
Host: vulnerable-host

Detection Methods for CVE-2024-28995

Indicators of Compromise

• Unexpected access to sensitive files
• Unusual HTTP requests containing traversal sequences
• Alerts for access to configuration files

Detection Strategies

Monitor network traffic for patterns indicative of directory traversal attempts and inspect web server logs for unexpected file access requests.

Monitoring Recommendations

Enable logging at the web server level to capture detailed request paths and implement file integrity monitoring for sensitive files to detect unauthorized access.

How to Mitigate CVE-2024-28995

Immediate Actions Required

• Restrict access rights for web server users
• Implement strict input validation
• Enable file access logging

Patch Information

SolarWinds has released security updates to address this vulnerability. Users are advised to apply the latest patches available from the SolarWinds advisory page.

Workarounds

Implement proper input filtering and validation to reject suspicious HTTP request paths that include traversal characters.

# Configuration example
# Restrict file access in web server configuration
<Directory "/var/www/html">
    Options -Indexes
    AllowOverride None
    Require all granted
</Directory>