- Table of contents
SolarWinds Orion API LFI
Supplementing the SolarWinds Security Bulletin released in mid-December 2020, detailing a suspected nation-state threat actor introducing a backdoor into SolarWinds Orion versions 2019.4 HF5, 2020.2 and 2020.2 HF1, this bulletin provides an update based on recent observations in late December 2020 and early January 2021.
In the first instance, the public release of a proof-of-concept (PoC) local file disclosure/inclusion (LFD/LFI) exploit on 28 December 2020 allows configuration and credentials to be stolen and as such has lead to multiple threat actors conducting widespread scanning activity in order to identify and target vulnerable SolarWinds Orion installations.
Given the increase in scanning activity along with widespread press and social media coverage, organizations are again reminded to follow earlier recommendations and isolate vulnerable hosts before updating SolarWinds Orion to the latest version as soon as possible. Furthermore, those that find themselves with vulnerable installations should take steps to investigate a potential breach.
Proof-of-Concept Local File Disclosure
Published to GitHub 28 December 2020 as a ‘Gist’  by a known security researcher named ‘0xsha’, the proof-of-concept (PoC) local file disclosure/inclusion (LFD/LFI), written in Python, allows a vulnerable installation to be determined before attempting to gather both configuration data and credentials (Figure 1).
Figure 1 – PoC Python script execution
Vulnerable File Version
Having requested the
/Orion/invalid.aspx.js file, the location header is queried to determine if a valid version for exploitation can be found (Figure 2).
Figure 2 – Leak File Version
Once confirmed as vulnerable, the PoC exploit will attempt to retrieve the
web.config file used in IIS and SolarWinds Orion potentially leading to the exposure of sensitive server configuration data (Figure 3).
Figure 3 – Leak Web Config
SWNetPerfMon.db file contains, according to SolarWinds, database connection information including credentials and is stored locally on the server within the following files:
C:\Program Files (x86)\SolarWinds\Orion\SWNetPerfMon.db
Utilizing the PoC, this file can be accessed remotely on a vulnerable installation (Figure 4) and subsequently downloaded.
Figure 4 – Leak Password Data
Once downloaded, a threat actor would then be able to decrypt the
SWNetPerfMon.db file using publicly available tools, such as a ‘Credential Dumping Tool’ shared by a researcher named Rob ‘Mubix’ Fuller  and as documented in various articles  , leading to plain text output (Figure 5) containing both the username and password of SolarWinds Orion users.
Figure 5 – Mubix Credential Dumping Tool output
The impact arising from the initial SolarWinds Orion vulnerability, tracked as CVE-2020-10148 and exploited in a campaign dubbed ‘SUNBURST’, remains severe and is compounded by the subsequent use of a web shell threat dubbed ‘SUPERNOVA’ along with the public release of this proof-of-concept code to gather configuration and credential data from vulnerable installations.
As such, the combination of both the vulnerability and the exploit could allow a malicious threat actor to obtain the SolarWinds Orion password database, chaining the authentication bypass vulnerability together with arbitrary file read resulting in local file disclosure.
In addition to vulnerable hosts being easily identifiable from open source searches, such as the query
http.title:solarwinds http.favicon.hash:-1776962843 on Shodan  (Figure 6), increased internet-wide scanning activity has been observed.
Figure 6 – Shodan search results
Affected versions of SolarWinds Orion remain the same as the initial vulnerability announcement :
- 2019.4 HF5
- 2020.2 (No hotfix)
- 2020.2 HF1
The initial vulnerability remains critical, potentially leading to full server compromise, and was previously assigned a CVSS v3 Base Score of 9.8.
As part of the exploitation process, threat actors will attempt to retrieve the following files using GET requests and as such HTTP access attempts for the targeted files should be monitored and reviewed:
- As previously detailed, organizations with vulnerable SolarWinds Orion installations should update as soon as possible:
- 2018.2, 2018.4 & 2019.2 SUPERNOVA Patch
- 2019.4 HF6
- 2020.2.1 HF2
- Aside from checking the software installed, a HTTP GET request to
/Orion/invalid.aspx.json a SolarWinds Orion server will identify the version to determine if it is vulnerable.
- Access logs should be monitored and reviewed for unexpected or suspicious access attempts to the
- Consideration should be given to explicitly blocking access to vulnerable pages and the named files.