CVE-2024-28995 is a high-severity path traversal vulnerability in SolarWinds Serv-U (versions 15.4.2 HF 1 and prior) that allows unauthenticated remote attackers to read arbitrary files from the host system. The flaw exists in the BuildLocalPath method due to improper validation of the InternalDir and InternalFile parameters, enabling attackers to bypass directory restrictions via crafted GET requests. Given confirmed active exploitation by both automated scanners and manual threat actors, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 17, 2024. Immediate remediation via upgrade to version 15.4.2 HF 2 is required to prevent sensitive system data exfiltration.

• Vulnerability Analysis: Path Traversal Logic

  • The flaw originates from an input validation failure within the BuildLocalPath function used to resolve file requests.
  • Attackers can manipulate the InternalDir and InternalFile parameters to traverse outside the intended root directory.
  • Successful exploitation allows the retrieval of any file on the disk that is not exclusively locked by another process.
  • The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

• Exploitation Vectors & Observed Patterns

  • Exploitation is performed via unauthenticated GET requests to the server root, making it trivially exploitable.
  • Threat intelligence from GreyNoise indicates a mix of automated mass-scanning and "hands-on-keyboard" manual attacks.
  • Attackers typically target sensitive configuration files, binary files, and user credentials to facilitate further system compromise.
  • Public proof-of-concept (PoC) code and bulk scanners have been released, accelerating the weaponization cycle.

• Risk Impact & Data Exposure

  • The vulnerability enables "smash-and-grab" attacks where adversaries quickly exfiltrate data for extortion or lateral movement.
  • High operational risk due to the potential exposure of system-level credentials and internal configuration data.
  • CVSS v3.1 scores range from 7.5 to 8.6, reflecting the low attack complexity and lack of required privileges.
  • Potential for secondary impacts, including server instability or crashes, depending on the files targeted during traversal.

• CISA Mandate & Regulatory Requirements

  • Inclusion in the KEV catalog mandates that US Federal Government agencies apply patches within strict timelines (per BOD 22-01).
  • The KEV designation serves as a high-priority signal for all organizations to prioritize this patch over standard maintenance cycles.
  • CISA's action was prompted by reliable evidence of in-the-wild exploitation targeting MFT (Managed File Transfer) solutions.

• Remediation & Defensive Strategy

  • Immediate upgrade to SolarWinds Serv-U 15.4.2 HF 2 is the only definitive fix to eliminate the traversal vector.
  • Organizations should deploy IPS signatures, such as those provided by FortiGuard, to detect and block InternalDir traversal attempts.
  • Security teams should audit system logs for unusual GET requests targeting root directories and verify the integrity of sensitive system files.
  • Implementing strict network segmentation and limiting the exposure of MFT interfaces can reduce the reachable attack surface.