CVE-2021-35247

What it actually does

The vulnerability is an improper input validation issue in the Serv-U web login flow when LDAP authentication is enabled. The login screen accepted characters that were not sufficiently sanitized before being passed into LDAP authentication logic, creating the potential for LDAP query manipulation or authentication logic tampering. The reported CVSS impact is limited to integrity because SolarWinds stated that downstream LDAP servers were observed ignoring the malformed characters; however, the flaw was added to CISA KEV and has been reported as exploited in the wild, so exposed systems should be treated as higher operational risk than the base score alone suggests.

Why it matters to the business

An internet-exposed Serv-U instance using LDAP authentication could allow attackers to tamper with login input and potentially influence authentication behavior. Even if exploitation does not directly expose data, successful abuse could support unauthorized access attempts, account misuse, or follow-on intrusion activity against file-transfer infrastructure. Because this vulnerability is in CISA KEV with a remediation due date of 2022-02-04 and has been known for years, continued exposure is a strong signal of patch-management risk and may attract opportunistic scanning.

How an attack unfolds

An attacker first identifies a reachable Serv-U web login interface, then determines whether LDAP-backed authentication is enabled or likely in use. The attacker submits crafted login values containing LDAP metacharacters or malformed input that the vulnerable login handler does not fully validate. If the server passes the unsafe value into LDAP authentication processing, the attacker attempts to alter the resulting LDAP evaluation or observe differences in login errors, timing, redirects, or account-lockout behavior. A successful exploit may allow authentication flow manipulation or provide a foothold for additional password-spraying, credential-stuffing, or post-authentication attacks against the file-transfer service. Known exploitation activity and KEV status mean defenders should assume public exploit knowledge and scanning activity exist even where no organization-specific indicators are available.

How to fix it

Upgrade Serv-U to the latest available vendor-supported version that includes the additional login input validation and sanitization. Where the software is consumed through Debian-packaged node-formidable entries listed in the provided package inventory, update to 3.2.4+20220519git81dd350+~cs4.0.9-1 or later for Debian 12, Debian 13, and Debian 14. If immediate upgrade is not possible, restrict access to the Serv-U web interface to trusted networks or VPN, disable LDAP authentication where operationally feasible, enforce MFA where supported, review LDAP bind permissions for least privilege, and monitor login activity for malformed input. Because the KEV remediation deadline has long passed, treat any unpatched internet-facing instance as urgent.

How to confirm the fix worked

Confirm the running Serv-U version is at or above the vendor-fixed release and that all OS or package-manager updates containing the fixed node-formidable version have been applied where relevant. Validate that the web login rejects or safely handles LDAP metacharacters such as asterisks, parentheses, backslashes, encoded null bytes, and malformed filter-like input without changing authentication behavior. Review configuration to determine whether LDAP authentication is enabled and whether the login interface is exposed externally. Use authenticated vulnerability scanning, package inventory, and service-version checks to verify remediation; then repeat targeted negative testing against a non-production or approved test instance to confirm malformed login input no longer reaches LDAP processing unsanitized.

Typical attack path

1. Scan the internet or target ranges for exposed SolarWinds Serv-U web login interfaces.
2. Identify instances that appear to support LDAP-backed authentication.
3. Send crafted login requests containing LDAP metacharacters or malformed characters in username or authentication fields.
4. Compare responses, errors, redirects, status codes, or timing to determine whether input is being handled unsafely.
5. Attempt authentication bypass, query manipulation, or account discovery depending on LDAP behavior and server configuration.
6. If access is obtained, use the file-transfer service to enumerate files, upload tools, stage data, or pivot using obtained credentials.

How to detect it

Look for evidence of malformed login attempts against the Serv-U web interface, especially where LDAP authentication is enabled. Useful sources include Serv-U application logs, web access logs or reverse-proxy logs in front of Serv-U, LDAP server logs, Windows Security event logs for logon activity, identity-provider logs, firewall/WAF logs, and EDR telemetry on the Serv-U host. Hunt for login requests containing LDAP metacharacters or encoded equivalents in username fields, such as asterisks, parentheses, backslashes, percent-encoded null bytes, or filter-like strings. Correlate failed malformed attempts with subsequent successful logins from the same IP address, source ASN, session, or user-agent. Review LDAP logs for unusual bind attempts, malformed filter errors, abnormal search filters, or authentication requests with suspicious usernames. Post-exploitation review should include new or modified Serv-U users, unexpected file uploads/downloads, permission changes, new administrative sessions, unusual child processes from the Serv-U service, and outbound network connections from the file-transfer server.

• username=*)(
• username=%2A%29%28
• username=*
• username=%00
• username=%5C
• (&(objectClass=*)
• LDAP filter error
• Invalid LDAP filter
• malformed LDAP
• Serv-U.log
• Domain.log
• POST /Login.aspx
• POST /?Command=Login
• Serv-U.exe

What your security team should do

• Prioritize patching or upgrading any internet-facing Serv-U instance, especially those using LDAP authentication, because the vulnerability is in CISA KEV and has observed exploitation activity.
• Inventory all Serv-U deployments and confirm whether LDAP authentication is enabled.
• Restrict external access to the Serv-U web login interface until patching is complete.
• Review web, application, LDAP, and identity-provider logs for historical malformed login attempts and unusual authentication outcomes.
• Check for successful logins following malformed failed attempts from the same source IP or user-agent.
• Harden file-transfer infrastructure by enforcing MFA where available, least-privilege LDAP bind accounts, strong password policies, and account lockout protections.
• Run compromise assessment on systems where suspicious authentication activity is found, including review of uploaded files, newly created users, changed permissions, and unexpected scheduled tasks or services.
• Document KEV remediation status for compliance and risk reporting because the CISA due date was 2022-02-04.