^{CVE-2020-27994:}Path Traversal Vulnerability in SolarWinds Serv-U FTP Server

Overview

This vulnerability (CVE-2020-27994) affects SolarWinds Serv-U FTP Server versions 15.2.1 and earlier. The issue stems from improper validation of user-supplied input, allowing authenticated users to traverse directory paths using "../" sequences or similar techniques. By exploiting this vulnerability, attackers can bypass directory restrictions and access files outside the designated FTP directories. This could lead to unauthorized access to sensitive system files, configuration files, or other critical data stored on the server. The vulnerability requires authentication, which somewhat limits its exploitation potential, but still presents a significant security risk for organizations using affected versions.

Remediation

To address this vulnerability, organizations should take the following steps:

1. Update to SolarWinds Serv-U version 15.2.2 or later, which contains the fix for this vulnerability.
2. If immediate updating is not possible, implement the following temporary mitigations:
   • Restrict FTP server access to trusted IP addresses only
   • Implement strong authentication mechanisms and regularly rotate credentials
   • Monitor FTP server logs for suspicious access patterns or unusual file access requests
   • Consider using a network-level firewall to further restrict access to the FTP server
3. Conduct a security review to determine if the vulnerability has been exploited:
   • Check logs for unusual file access patterns
   • Verify the integrity of critical system files
   • Look for evidence of unauthorized data access or exfiltration
4. Review user permissions and implement the principle of least privilege for all FTP accounts

References

1. SolarWinds Serv-U 15.2.2 Release Notes: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm
2. Path Traversal in SolarWinds Serv-U File Server <=15.2.1: http://seclists.org/fulldisclosure/2021/Feb/36
3. SolarWinds Serv-U FTP Server 15.2.1 Path Traversal Exploit: http://packetstormsecurity.com/files/161399/SolarWinds-Serv-U-FTP-Server-15.2.1-Path-Traversal.html
4. The Missing Link Security Advisory for CVE-2020-27994: https://www.themissinglink.com.au/security-advisories-cve-2020-27994
5. CWE-22: Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html