CVE-2024-45717: SolarWinds Platform XSS Vulnerability

CVE-2024-45717 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in the SolarWinds Platform affecting the search and node information sections of the user interface. This vulnerability allows an authenticated attacker to inject malicious scripts that execute in the context of a victim user's browser session. While the vulnerability requires both authentication and user interaction to exploit, successful exploitation could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim user.

Critical Impact

Authenticated attackers on the adjacent network can execute malicious scripts in victim browsers, potentially compromising session data and enabling further attacks against the SolarWinds Platform infrastructure.

Affected Products

• SolarWinds Platform (versions prior to 2024.4.1)
• SolarWinds Orion Platform components utilizing the vulnerable search interface
• SolarWinds Platform node information display modules

Discovery Timeline

• 2024-12-04 - CVE-2024-45717 published to NVD
• 2025-02-06 - Last updated in NVD database

Technical Details for CVE-2024-45717

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists within the search functionality and node information display components of the SolarWinds Platform user interface. When user-supplied input is processed by these components, insufficient sanitization allows specially crafted input containing JavaScript code to be reflected back to users and executed within their browser context.

The attack requires the adversary to be on an adjacent network and possess valid authentication credentials. Additionally, victim interaction is necessary for successful exploitation, as the malicious payload must be triggered through specific user actions such as clicking a crafted link or viewing manipulated search results.

Root Cause

The root cause of CVE-2024-45717 lies in inadequate input validation and output encoding within the SolarWinds Platform's web interface. The search and node information sections fail to properly sanitize user-controlled input before rendering it in the HTML response. This oversight allows attackers to inject arbitrary HTML and JavaScript content that the browser interprets as legitimate code, rather than treating it as data to be displayed.

Attack Vector

The attack vector for this vulnerability requires an attacker to be positioned on an adjacent network segment (such as the same local network or VLAN) as the target SolarWinds Platform deployment. The attacker must first authenticate to the platform, then craft a malicious payload containing JavaScript code designed to execute when processed by the vulnerable search or node information components.

The exploitation typically follows this pattern: the attacker injects a malicious script through the search interface or node information fields, then entices a victim user with higher privileges to interact with the crafted content. When the victim's browser renders the unsanitized input, the malicious script executes with the victim's session privileges, potentially allowing the attacker to steal session tokens, modify data, or perform administrative actions.

Detection Methods for CVE-2024-45717

Indicators of Compromise

• Unusual JavaScript patterns in URL parameters or search queries submitted to the SolarWinds Platform
• HTTP requests containing encoded script tags (<script>, %3Cscript%3E) in search fields or node information inputs
• Unexpected outbound connections from user browsers following SolarWinds Platform access
• Authentication anomalies or session token usage from unexpected IP addresses

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS payloads in requests to SolarWinds Platform endpoints
• Monitor HTTP access logs for suspicious patterns including encoded HTML entities and JavaScript event handlers
• Deploy browser-based security controls to detect script injection attempts
• Utilize SentinelOne's Singularity Platform to monitor for post-exploitation behavior indicative of compromised user sessions

Monitoring Recommendations

• Enable detailed logging for the SolarWinds Platform search and node information API endpoints
• Configure alerting for high volumes of failed or suspicious search queries from individual users
• Monitor for unusual administrative actions that may indicate session hijacking
• Review browser console logs for JavaScript errors that may indicate attempted XSS exploitation

How to Mitigate CVE-2024-45717

Immediate Actions Required

• Upgrade SolarWinds Platform to version 2024.4.1 or later, which contains the security fix for this vulnerability
• Review and restrict network access to the SolarWinds Platform to authorized users and network segments only
• Implement Content Security Policy (CSP) headers to mitigate XSS impact if immediate patching is not possible
• Educate users about the risks of clicking suspicious links related to the SolarWinds Platform

Patch Information

SolarWinds has released a security patch addressing this vulnerability in SolarWinds Platform version 2024.4.1. Organizations should prioritize applying this update to remediate the XSS vulnerability. The patch includes improved input validation and output encoding for the affected search and node information components. For detailed release notes and upgrade instructions, refer to the SolarWinds Platform Release Notes. Additional information is available in the SolarWinds Security Advisory for CVE-2024-45717.

Workarounds

• Restrict SolarWinds Platform access to trusted network segments using firewall rules or network segmentation
• Implement strict Content Security Policy headers to prevent inline script execution
• Limit user permissions to reduce the impact of potential session compromise
• Deploy a web application firewall with XSS protection rules in front of the SolarWinds Platform

# Example: Content Security Policy header configuration for Apache
# Add to httpd.conf or .htaccess to mitigate XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"