CVE-2024-28995

What it actually does

CVE-2024-28995 is an unauthenticated path traversal vulnerability in SolarWinds Serv-U that allows a remote attacker to read arbitrary sensitive files from the underlying host by manipulating file path input. Because exploitation requires no credentials or user interaction and can be performed over the network, the main technical consequence is high-impact confidentiality loss, including potential exposure of configuration files, credentials, private keys, logs, scripts, and other locally accessible files. The vulnerability does not directly provide code execution or file modification, but stolen secrets can enable follow-on compromise of Serv-U, connected systems, or other infrastructure.

Why it matters to the business

A vulnerable SolarWinds Serv-U deployment can leak sensitive operational data to an unauthenticated internet-based attacker. This may expose credentials, customer or partner file-transfer data, certificates, internal paths, and configuration details that support further intrusion, fraud, data theft, or regulatory notification obligations. The issue is listed in CISA Known Exploited Vulnerabilities with a remediation due date of 2024-08-07, has active exploitation in the wild, and has an extremely high EPSS score of 0.99614, so organizations should treat exposed instances as urgent and potentially already targeted.

How an attack unfolds

An attacker first identifies an exposed SolarWinds Serv-U service, commonly by scanning internet-facing file transfer infrastructure. They then send crafted HTTP requests containing traversal sequences that cause Serv-U to resolve a requested path outside the intended web or file-transfer directory. If the request succeeds, Serv-U returns the contents of files on the host that the service process can read. The attacker typically starts with predictable files such as Windows system files, Serv-U configuration files, application logs, SSH keys, certificate files, backup files, or scripts containing credentials. Any recovered secrets can then be used to authenticate to Serv-U, move laterally, access transferred data, or compromise adjacent infrastructure. Public reporting and KEV inclusion indicate exploitation has occurred in the wild, so successful attacks may leave only web access traces unless the attacker uses stolen credentials afterward.

How to fix it

Upgrade SolarWinds Serv-U to a vendor-fixed release as soon as possible; consult the current SolarWinds advisory for the exact fixed build applicable to Serv-U FTP Server, Serv-U Gateway, Serv-U MFT Server, and related components because no fixed version was provided in the input. If immediate patching is not possible, restrict Serv-U access to trusted IP ranges or VPN-only access, block internet exposure, place the service behind a properly configured reverse proxy or WAF rule that denies traversal patterns, and disable unnecessary Serv-U services. Run the Serv-U service under a least-privilege account with minimal filesystem read access, remove secrets from local files where possible, rotate credentials and keys that may have been readable, and review configuration files for embedded passwords or tokens. Because this vulnerability is actively exploited and listed in KEV, mitigation should be considered temporary only; patching and credential rotation are the durable controls.

How to confirm the fix worked

Confirm the installed SolarWinds Serv-U version and build against the SolarWinds security advisory for CVE-2024-28995 and verify it is at or above the fixed release for the deployed product line. Validate that Serv-U is not directly reachable from untrusted networks unless explicitly required and protected by access controls. Review web, Serv-U, reverse proxy, WAF, and network logs for blocked or successful requests containing traversal sequences, encoded traversal characters, or attempts to retrieve known operating system files. After patching, perform an authorized benign test from an external network to verify traversal requests are rejected and do not return file contents. Confirm the Serv-U process account has least-privilege filesystem permissions and that credential, certificate, and key rotation was completed for any secrets that may have been exposed.

Typical attack path

1. Scan for internet-facing SolarWinds Serv-U instances and identify accessible web or file-transfer endpoints.
2. Send unauthenticated requests containing path traversal sequences such as ../ or encoded variants to escape the intended directory.
3. Attempt to read known local files to confirm vulnerability and determine operating system, installation paths, and permissions.
4. Retrieve Serv-U configuration, logs, keys, certificates, scripts, backups, or other sensitive files readable by the Serv-U process.
5. Extract credentials, tokens, private keys, usernames, internal hostnames, and operational details from downloaded files.
6. Use stolen information for authenticated access, data theft, persistence, lateral movement, or additional compromise of related systems.

How to detect it

Investigate Serv-U HTTP access logs, Serv-U domain and management logs, reverse proxy logs, WAF alerts, firewall logs, NetFlow, and EDR telemetry for unauthenticated requests containing path traversal sequences or attempts to retrieve known local files. Look for repeated requests with ../, ..\, URL-encoded traversal such as %2e%2e%2f, double-encoded traversal, absolute Windows paths, Linux paths, or requests for Serv-U configuration and log files. Prioritize activity from external IPs, high request rates, 200 responses with abnormal response sizes, and requests followed by successful authentication, configuration changes, new user creation, unusual file transfers, or connections from the same source using newly exposed credentials. On hosts, review whether sensitive files were accessed by the Serv-U process at unusual times, and inspect EDR file-read telemetry if available. If exploitation is suspected, collect Serv-U logs, web/proxy logs, memory and process metadata, configuration files, user lists, scheduled tasks, recent login history, and evidence of credential use against other services.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %2e%2e%5c
• ..%5c
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /proc/self/environ
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• C:\\Windows\\System32\\config\\SAM
• C:\\Windows\\System32\\config\\SYSTEM
• Serv-U-StartupLog.txt
• Serv-U-FTPServer.log
• Serv-U-Gateway.log
• Serv-U-FileServer.ini
• Serv-U-ManagementServer.ini
• Serv-U.Archive
• SolarWinds Serv-U
• GET *../*
• GET *%2e%2e%2f*
• GET *..%5c*

What your security team should do

• Immediately inventory all SolarWinds Serv-U instances, including internet-facing, internal, gateway, MFT, FTP, and test deployments.
• Prioritize emergency patching or vendor-recommended hotfix deployment for all exposed Serv-U systems because exploitation is active, EPSS is extremely high, and the vulnerability is in CISA KEV.
• If patching cannot be completed immediately, remove public exposure, restrict access to trusted IPs or VPN, and deploy WAF or proxy rules blocking traversal patterns as a short-term containment measure.
• Search historical Serv-U, web server, proxy, WAF, EDR, and network logs for traversal attempts and suspicious file reads, especially before and after the public disclosure date of 2024-06-06.
• Assume exposed vulnerable systems may have leaked secrets; rotate Serv-U administrator credentials, service account passwords, SSH keys, API tokens, certificates, and any credentials stored in configuration files or scripts readable by the service.
• Review Serv-U file system permissions and ensure the service account cannot read unnecessary OS, application, backup, or credential files.
• Monitor for follow-on activity using credentials or keys associated with Serv-U, including unusual logins, new users, changed transfer jobs, unexpected downloads, and connections from unfamiliar IP addresses.
• Document remediation evidence for KEV compliance, noting the CISA due date of 2024-08-07 where applicable.