SolarWinds has patched a new Serv-U vulnerability discovered by Microsoft that threat actors attempted to use to propagate Log4j attacks to internal LDAP servers.
Serv-U can be configured to authenticate users against an internal LDAP server, such as a Windows domain controller or OpenLDAP server.
This new Serv-U vulnerability allowed threat actors to propagate a query, in this case Log4Shell exploit attempts, to internal LDAP servers used to authenticate users. However, as Windows domain controllers are not vulnerable to Log4j exploits, the attacks failed.
Microsoft says that they discovered the previously unknown Serv-U vulnerability during their continued monitoring of Log4j attacks.
The new Serv-U vulnerability
The bug is an input validation vulnerability discovered by Microsoft security researcher Jonathan Bar Or that allows an attacker to create a query and send it unsanitized over the network.
"During our sustained monitoring of threats taking advantage of the Log4j 2 vulnerabilities, we observed activity related to attacks being propagated via a previously undisclosed vulnerability in the SolarWinds Serv-U software," Microsoft explains in an update to their Log4J advisory.
"We discovered that the vulnerability, now tracked as CVE-2021-35247, is an input validation vulnerability that could allow attackers to build a query given some input and send that query over the network without sanitation."
Yesterday, SolarWinds issued an advisory for CVE-2021-35247 and released Serv-U 15.3 to fix the vulnerability.
"The Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized," reads SolarWinds advisory.
"SolarWinds has updated the input mechanism to perform additional validation and sanitization."
SolarWinds states that the attempted abuse of this vulnerability had no downstream effect "as the LDAP servers ignored improper characters." In other words, the servers were not vulnerable to Log4j attacks.
Threat actors have previously abused Serv-U vulnerabilities to perform Conti ransomware attacks and other undisclosed attacks.
BleepingComputer has reached out to Microsoft and SolarWinds with further questions but has not heard back at this time.
Update 1/20/22: Added further information about the attacks.
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now