Title:

SolarWinds Log & Event Manager – Improper Access Control

Release Date:

May 12, 2017

Patch Date:

April 10, 2017

Reported Date:

February 7, 2017

Vendor:

SolarWinds

Systems Affected:

SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4

Summary:

An improper access control vulnerability was discovered in the SolarWinds’ Log & Event Manager (LEM) management console (CMC). The CMC is a restricted environment providing functionality for upgrading or maintaining LEM appliances. This vulnerability allows an authenticated user to bypass restrictions imposed by the CMC and browse the underlying server’s filesystem, as well as read the contents of arbitrary files contained within.

Vendor Status:

The vendor has been notified and has issued patches.

Exploit Availability:

To demonstrate the impact of this vulnerability, the assessment team browsed the filesystem of the SolarWinds appliance to locate and then read the file containing the admin user’s password hash.

By running the editbanner command in the LEM CLI, a nano session was opened, as shown below:

Figure 1

Figure 1 – nano in restricted mode, as called from SolarWinds LEM CLI

Although not displayed, the key bindings to read a file (^R), or to open the filesystem browser (^R, ^T) were still available, and using them resulted in the following display:

Figure 2

Figure 2 – Browsing SolarWinds server’s filesystem in nano text editor

After navigating to the directory /usr/local/contego/run/manager, the file UserContextLibrary.xml was selected. Its contents, which included the administrative user’s password hash, were dumped into nano’s buffer:

/usr/local/contego/run/manager/UserContextLibrary.xml

Figure 3

Figure 3 – Administrative user’s hash visible from nano editor

This proof of concept demonstrated that it is possible to escape the access controls implemented by the SolarWinds LEM CLI and the installed nano text editor to browse the underlying filesystem and read arbitrary files. 

Researcher:

Baker Hamilton, MD, MMSc of Bishop Fox

For Reference:

The team at Bishop Fox would like to thank SolarWinds for their cooperation in quickly resolving this matter!