[BreachExchange] SolarWinds Confirms New Zero-Day Flaw Under Attack

[Sophia Kingsbury]

https://www.securityweek.com/solarwinds-confirms-new-zero-day-flaw-under-attack

Security responders at SolarWinds are scrambling to contain a new zero-day
vulnerability being actively exploited in what is being described as
“limited, targeted attacks.”

In an advisory issued over the weekend, SolarWinds said a single threat
actor exploited security flaws in its Serv-U Managed File Transfer and
Serv-U Secure FTP products to launch malware attacks against “a limited,
targeted set of customers.”

This zero-day is new and completely unrelated to the SUNBURST supply chain
attacks, the company said.

The embattled company said the attacks were discovered by threat hunters at
Microsoft who noticed live, in-the-wild attacks hitting a remote code
execution flaw in the SolarWinds Serv-U product.

Microsoft provided a proof of concept of the exploit along with evidence of
the zero-day attacks.

“Microsoft has provided evidence of limited, targeted customer impact,
though SolarWinds does not currently have an estimate of how many customers
may be directly affected by the vulnerability. SolarWinds is unaware of the
identity of the potentially affected customers,” the company said.

“While Microsoft’s research indicates this vulnerability exploit involves a
limited, targeted set of customers and a single threat actor, our joint
teams have mobilized to address it quickly,” SolarWinds added.

SolarWinds has shipped an urgent hotfix  -- available at the customer
portal -- to address the vulnerability, which affects Serv-U 15.2.3 HF1 and
all prior Serv-U versions.

The company has released some Indicators of Compromise (IOCs) to help
detect signs of compromise but full technical details of the vulnerability
will be kept under wraps to give customers time to test and deploy the
newest patches.

>From the SolarWinds advisory:

The vulnerability exists in the latest Serv-U version 15.2.3 HF1 released
May 5, 2021, and all prior versions. A threat actor who successfully
exploited this vulnerability could run arbitrary code with privileges. An
attacker could then install programs; view, change, or delete data; or run
programs on the affected system.

Serv-U version 15.2.3 hotfix (HF) 2 has been released. Please see the
Security Updates table for the applicable update for your system. We
recommend you install these updates immediately. If you are unable to
install these updates, see the FAQ in this Security Advisory for
information on how to help protect your system from this vulnerability.

The company pointed out that this vulnerability is not related to the
supply chain attack discovered last year. SolarWinds’ most recent
announcement regarding that attack, which has been attributed to Russian
threat actors, claimed that while thousands of customers received malicious
updates from its systems following a breach, less than 100 were actually
compromised.

Threat actors linked to China have also targeted SolarWinds. However, they
did not breach the company’s systems — they exploited a vulnerability in
SolarWinds’ Orion product and only delivered malware after gaining access
to the targeted networks. At least one U.S. government agency was targeted
in this operation.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20210712/8feda891/attachment.html>