CVE-2021-35211: SolarWinds Serv-U Managed File Transfer Zero-Day Vulnerability Exploited in Targeted Attacks

Following a patch for a zero-day vulnerability in SolarWinds’ Serv-U Managed File Transfer, researchers share new details about the attacks, as over 8,000 systems remain publicly accessible and potentially vulnerable.

Background

On July 9, SolarWinds published a security advisory for a significant security vulnerability in its Serv-U Managed File Transfer Server software, used for secure file transfers and file sharing.

In its initial advisory, SolarWinds credited Microsoft with discovering the vulnerability, adding that it had been exploited in the wild in “a limited, target” set of attacks.

On July 13, Microsoft published a blog post providing additional insight into their discovery of the flaw and the exploitation activity associated with it.

Analysis

CVE-2021-35211 is a memory escape vulnerability in SolarWinds Serv-U Managed File Transfer Server. The flaw exists due to the way Serv-U has implemented the Secure Shell (SSH) protocol and can only be exploited if an organization has made the Serv-U SSH protocol externally accessible. Microsoft says that, if exploited, an attacker would be able to “remotely run arbitrary code with privileges,” which may include but is not limited to installing or executing malicious code, as well as accessing or altering data on the system.

In-the-wild exploitation linked to an unidentified threat actor

In its blog post, Microsoft says they attribute the exploitation of the flaw to a group they are calling DEV-0322. The terminology, DEV, is used to describe a “development group” along with a unique number. This is similar to the methodology used by researchers at FireEye/Mandiant, who refer to uncategorized threat actors using the acronym UNC along with a group number.

Despite the unidentified nature of the group, Microsoft says the attackers have targeted software companies as well as the U.S. Defense Industrial Base Sector, which the Cybersecurity and Infrastructure Security Agency (CISA) says is responsible for researching, developing, designing, producing, delivering and maintaining military weapons systems.

Over 8,000 Serv-U SSH Servers publicly accessible

According to a search on BinaryEdge, there are over 8,000 Serv-U SSH Servers publicly accessible on the internet, with the majority of those systems residing in China, followed by the United States and Germany.

It is unclear from the banner results which of these systems have applied the patch thus far. Considering the volume of publicly accessible systems, once a proof-of-concept (PoC) becomes available, we anticipate attackers will begin targeting these systems indiscriminately.

Proof of concept

At the time this blog post was published, there were no PoC exploit scripts publicly available.

Solution

SolarWinds says that Serv-U versions 15.2.3 Hotfix 1 (HF1) and prior are affected by this vulnerability. To address the flaw, SolarWinds has released Serv-U 15.2.3 Hotfix 2 (HF2). They’ve provided a list of upgrade paths depending on the current version of Serv-U that is being used.

In Microsoft’s blog post, they’ve shared a series of indicators of compromise and guidance on how to identify potential compromise through examining the Serv-U log file, DebugSocketLog.txt, for exception messages.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.