CVE-2022-38108 : Security Advisory and Response

A security vulnerability CVE-2022-38108 was discovered in the SolarWinds Platform, where an attacker with Orion admin-level account access can execute arbitrary commands through the deserialization of untrusted data.

Understanding CVE-2022-38108

This section provides detailed insights into the nature of the vulnerability, its impact, technical details, and mitigation strategies.

What is CVE-2022-38108?

The CVE-2022-38108 vulnerability in SolarWinds Platform allows an adversary to maliciously execute arbitrary commands using the deserialization of untrusted data. This poses a significant security risk to systems with the affected versions.

The Impact of CVE-2022-38108

The impact of CVE-2022-38108 is rated as HIGH, with a CVSS v3.1 base score of 7.2. An attacker with Orion admin-level account access can exploit the vulnerability to execute arbitrary commands, leading to potential compromise of confidentiality, integrity, and availability of the system.

Technical Details of CVE-2022-38108

In this section, we delve into specific technical aspects of the vulnerability to provide a comprehensive understanding.

Vulnerability Description

The vulnerability arises from the improper handling of deserialization of untrusted data in the SolarWinds Platform, allowing remote attackers to execute arbitrary commands.

Affected Systems and Versions

The SolarWinds Platform versions prior to 2022.3 and Orion Platform versions prior to 2020.2.6 HF5 are susceptible to this vulnerability.

Exploitation Mechanism

Attackers with Orion admin-level account access exploit the deserialization of untrusted data to execute arbitrary commands on the affected systems.

Mitigation and Prevention

This section outlines strategies to mitigate the CVE-2022-38108 vulnerability and prevent potential exploitation.

Immediate Steps to Take

SolarWinds recommends upgrading to version 2022.4 of the SolarWinds Platform as soon as it becomes available. Additionally, follow the secure configuration guide to restrict unauthorized access and implement proper network segmentation controls.

Long-Term Security Practices

Ensure strict access controls, disable unnecessary ports and services, and apply segmentation controls to enhance the security posture of the SolarWinds Platform and associated systems.

Patching and Updates

Regularly apply security patches and updates to the SolarWinds Platform to address known vulnerabilities and safeguard against potential exploits.