CVE-2024-28996: SolarWinds Platform SQLI Vulnerability

CVE-2024-28996 Overview

CVE-2024-28996 is a SWQL (SolarWinds Query Language) Injection vulnerability affecting the SolarWinds Platform. This vulnerability allows attackers with adjacent network access to inject malicious SWQL queries, potentially compromising the confidentiality, integrity, and availability of the affected system. While the attack complexity is high, successful exploitation could lead to unauthorized data access and manipulation of the underlying database structures.

Critical Impact

Adjacent network attackers can exploit SWQL injection to compromise database operations, potentially accessing sensitive network monitoring data and configuration information stored in the SolarWinds Platform.

Affected Products

• SolarWinds Platform (versions prior to 2024.2)
• SolarWinds Orion Platform components utilizing SWQL query interfaces

Discovery Timeline

• June 4, 2024 - CVE-2024-28996 published to NVD
• February 26, 2025 - Last updated in NVD database

Technical Details for CVE-2024-28996

Vulnerability Analysis

This vulnerability is classified as a SWQL Injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). SWQL is SolarWinds' proprietary query language used to interact with the Orion database. The injection vulnerability occurs when user-controlled input is improperly sanitized before being incorporated into SWQL queries.

The attack requires adjacent network access, meaning the attacker must be on the same network segment as the target SolarWinds Platform installation. While this limits the attack surface compared to remote network attacks, organizations with flat network architectures or inadequate network segmentation remain at elevated risk.

Successful exploitation could allow attackers to extract sensitive network monitoring data, modify configuration settings, or potentially disrupt monitoring operations. Given SolarWinds Platform's role in enterprise network monitoring, compromise could provide attackers with detailed network topology information and system credentials.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of user-supplied data before it is processed by the SWQL query engine. When specially crafted input containing SWQL syntax elements is passed to vulnerable query handlers, the malicious content is interpreted as part of the query structure rather than as data, enabling injection attacks.

Attack Vector

The attack vector requires adjacent network positioning, indicating the attacker must have local network access to reach the vulnerable SolarWinds Platform instance. The exploitation process involves:

1. Identifying input fields or API endpoints that accept SWQL-processed data
2. Crafting malicious payloads containing SWQL injection syntax
3. Submitting the payload to manipulate query logic
4. Extracting unauthorized data or modifying database contents

The high attack complexity rating indicates that successful exploitation requires specific conditions or additional steps beyond basic injection techniques, such as bypassing certain validation mechanisms or chaining with other vulnerabilities.

Detection Methods for CVE-2024-28996

Indicators of Compromise

• Unusual or malformed SWQL queries appearing in SolarWinds Platform logs
• Unexpected database query patterns or high-volume data extraction events
• Authentication anomalies or unauthorized access attempts to SWQL interfaces
• Error messages indicating query syntax violations from injection attempts

Detection Strategies

• Monitor SolarWinds Platform application logs for query injection patterns and syntax errors
• Implement network traffic analysis to detect anomalous traffic to SolarWinds services from adjacent network segments
• Deploy database activity monitoring to identify unusual query patterns or bulk data access
• Review audit logs for failed authentication attempts and privilege escalation indicators

Monitoring Recommendations

• Enable verbose logging for SWQL query processing components
• Configure alerting for database query anomalies and error rate spikes
• Implement network segmentation monitoring to detect unauthorized adjacent network access
• Establish baseline metrics for normal SWQL query patterns to identify deviations

How to Mitigate CVE-2024-28996

Immediate Actions Required

• Upgrade to SolarWinds Platform version 2024.2 or later immediately
• Review network segmentation to restrict adjacent network access to SolarWinds infrastructure
• Audit user accounts with access to SWQL query interfaces and enforce least privilege
• Enable enhanced logging to capture potential exploitation attempts during the upgrade window

Patch Information

SolarWinds has addressed this vulnerability in the SolarWinds Platform 2024.2 release. Organizations should consult the SolarWinds Platform 2024.2 Release Notes for complete upgrade instructions and the SolarWinds Security Advisory for additional technical details.

The patch implements improved input validation and sanitization for SWQL query parameters, preventing malicious injection payloads from being interpreted as query syntax.

Workarounds

• Implement strict network segmentation to isolate SolarWinds Platform from untrusted network segments
• Restrict access to SWQL query interfaces through firewall rules and access control lists
• Enable web application firewall rules to filter potentially malicious query parameters
• Disable or restrict access to non-essential SWQL-exposed endpoints until patching is complete

# Network segmentation example - restrict access to SolarWinds services
# Adjust firewall rules to limit adjacent network access

# Example iptables rule to restrict access to SolarWinds web interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Example Windows Firewall rule to restrict SolarWinds access
netsh advfirewall firewall add rule name="Restrict SolarWinds Access" dir=in action=allow protocol=tcp localport=443 remoteip=10.0.0.0/24