A series of critical security vulnerabilities have been identified in SolarWinds Access Rights Manager (ARM), a tool widely used for managing user permissions and auditing identity across enterprise environments. According to SANS ISC, these flaws present a significant risk because they allow unauthenticated actors to bypass security controls and gain high-level access to the host system. The most widespread issue, tracked as CVE-2024-28995, is a high-severity directory traversal vulnerability that enables an attacker to access files outside the intended web root.
SolarWinds Access Rights Manager RCE Mitigation
While directory traversal is serious on its own, it is often used as an initial entry point for more complex attacks. When paired with other vulnerabilities such as CVE-2024-28996 and CVE-2024-28999, the risk profile escalates to RCE. These latter flaws involve insecure deserialization and the presence of hardcoded credentials, both of which can grant an APT group complete control over the ARM instance. Because this software typically runs with extensive privileges to manage Active Directory and other identity stores, a compromise here often facilitates Privilege Escalation and subsequent Lateral Movement throughout the network.
Security professionals must prioritize how to detect CVE-2024-28995 exploit attempts by auditing web server access logs for suspicious patterns. Specifically, look for URI requests containing ”../” sequences or encoded equivalents that attempt to access sensitive configuration files or system binaries. The presence of such IoC markers should trigger an immediate incident response investigation within the SOC.
Technical Impact and Exposure
The CVSS scores for several of these vulnerabilities reach 9.8, underscoring the critical nature of the threat. The core issue lies in the lack of proper input validation for unauthenticated requests, allowing an attacker to manipulate file paths or inject malicious objects into the data stream. If a threat actor successfully exploits these flaws, they can deploy a C2 framework or initiate a Ransomware attack by leveraging the high-level service accounts associated with the ARM installation.
SolarWinds ARM 2024.3 Patch Guidance
The vendor has released a comprehensive update to address these security concerns. Following the SolarWinds ARM 2024.3 patch guidance, organizations should immediately upgrade all instances of Access Rights Manager to version 2024.3. Beyond patching, defenders should implement a Zero Trust architecture that limits network-level access to the ARM management interface. Only authorized administrative subnets or secure VPN gateways should be allowed to communicate with these servers.
Furthermore, deploying an EDR solution on the server hosting SolarWinds ARM can provide the necessary visibility to detect post-exploitation behavior. Integrating these logs into a SIEM allows for automated alerting on anomalous process creation or unauthorized file access. Given the history of Supply Chain Attack vectors targeting infrastructure management tools, a proactive and defense-in-depth approach is necessary to ensure the continued integrity of the identity perimeter. If organizations cannot patch immediately, they should consider isolating the affected systems from the internet and monitoring for any Zero-Day activity that suggests active exploitation.