CVE-2024-28999: SolarWinds Platform Race Condition Flaw

CVE-2024-28999 Overview

CVE-2024-28999 is a race condition vulnerability affecting the SolarWinds Platform web console. The flaw, classified under [CWE-362], allows an adjacent network attacker to exploit concurrent execution using shared resources without proper synchronization. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected system.

SolarWinds addressed the issue in SolarWinds Platform 2024.2. The vulnerability requires no authentication and no user interaction, though attack complexity is high due to the timing-dependent nature of race conditions.

Critical Impact

An adjacent network attacker can exploit a timing flaw in the SolarWinds Platform web console to gain unauthorized impact on system confidentiality, integrity, and availability without authentication.

Affected Products

• SolarWinds Platform versions prior to 2024.2
• SolarWinds Orion-based monitoring deployments running the affected web console
• All SolarWinds Platform modules dependent on the vulnerable web console component

Discovery Timeline

• 2024-06-04 - CVE-2024-28999 published to the National Vulnerability Database
• 2025-02-26 - Last updated in NVD database

Technical Details for CVE-2024-28999

Vulnerability Analysis

The SolarWinds Platform web console contains a race condition in how it handles concurrent requests against shared resources. When two or more operations execute in parallel without proper synchronization, an attacker can manipulate the sequence of state changes to bypass intended controls. The window between the check and use of a resource creates an exploitable timing gap.

Because the web console is accessible over the network and processes privileged operations, successful exploitation has direct implications for system integrity. The Exploit Prediction Scoring System ranks this issue in the upper percentile of CVEs, signaling elevated likelihood of exploit activity relative to the broader CVE population.

Root Cause

The root cause is improper synchronization of concurrent operations within the web console, tracked as [CWE-362] Concurrent Execution using Shared Resource with Improper Synchronization. Shared state is read and modified across threads or request handlers without locking, atomic operations, or transactional guarantees. An attacker who issues carefully timed requests can interleave operations to reach an inconsistent state.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must reside on the same logical network segment as the SolarWinds Platform server. No credentials and no user interaction are required. The attacker sends concurrent crafted requests to the web console, racing the application's resource handling logic. Successful exploitation grants the attacker the ability to influence confidentiality, integrity, and availability of monitored data and platform operations.

No verified exploit code is publicly available, though the vulnerability is referenced in Exploit-DB sources. Refer to the SolarWinds Security Advisory CVE-2024-28999 for additional vendor detail.

Detection Methods for CVE-2024-28999

Indicators of Compromise

• Bursts of concurrent or near-simultaneous HTTP requests to the same SolarWinds Platform web console endpoint from a single adjacent source
• Unexpected configuration or state changes in the web console without corresponding administrator activity
• Anomalous authentication or session events originating from non-management network segments

Detection Strategies

• Inspect web server and application logs on the SolarWinds Platform host for high-frequency parallel requests targeting the same resource or endpoint
• Baseline normal administrative traffic patterns and alert on deviations, particularly from hosts not designated for SolarWinds management
• Correlate web console activity with platform audit logs to surface state transitions inconsistent with logged operator actions

Monitoring Recommendations

• Forward SolarWinds Platform web console, IIS, and Windows event logs to a centralized SIEM for retention and correlation
• Monitor east-west traffic to the SolarWinds management subnet using network detection tooling
• Track installed SolarWinds Platform versions across the environment and alert when hosts remain on releases prior to 2024.2

How to Mitigate CVE-2024-28999

Immediate Actions Required

• Upgrade the SolarWinds Platform to version 2024.2 or later, which contains the vendor-supplied fix
• Restrict network access to the SolarWinds Platform web console to a dedicated management VLAN or jump-host subnet
• Audit recent web console activity for evidence of concurrent request abuse or unauthorized configuration changes

Patch Information

SolarWinds released the fix in SolarWinds Platform 2024.2. Patch details are documented in the SolarWinds Platform 2024.2 Release Notes and the SolarWinds Security Advisory CVE-2024-28999. Customers should follow the vendor's documented upgrade procedure and validate platform health after the upgrade.

Workarounds

• Limit the web console to administrators by enforcing firewall rules that permit access only from authorized management hosts
• Require VPN or zero-trust network access for any administrator interacting with the SolarWinds Platform web console
• Place the SolarWinds Platform server behind a reverse proxy that rate-limits and serializes concurrent requests to sensitive endpoints until patching completes

# Example: restrict access to the SolarWinds web console with Windows Firewall
New-NetFirewallRule -DisplayName "SolarWinds Web Console - Management Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 80,443 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "SolarWinds Web Console - Block Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 80,443 `
  -Action Block