SolarWinds has announced patches for two vulnerabilities in its Active Directory (AD) and Azure AD user provisioning tool Access Rights Manager, including a critical-severity bug.
Tracked as CVE-2024-28991 (CVSS score of 9.0), the critical security defect could allow remote attackers to execute arbitrary code on an affected system.
“If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution,” SolarWinds notes in its advisory. The company has credited Piotr Bazydlo of Trend Micro’s Zero Day Initiative for reporting the issue.
A ZDI advisory reveals that CVE-2024-28991 is a deserialization of untrusted data flaw that exists because user-supplied data is not properly validated.
“An attacker can leverage this vulnerability to execute code in the context of SYSTEM,” ZDI explains, noting that the issue has a CVSS score of 9.9.
The advisory also shows that, while authentication is required to exploit this security defect, an attacker can bypass the existing authentication mechanism.
The second issue resolved in Access Rights Manager is a hardcoded credential vulnerability that could allow an attacker to bypass authentication and access the RabbitMQ management console. Tracked as CVE-2024-28990, it was also reported by Piotr Bazydlo.
“The specific flaw exists within the configuration of a RabbitMQ instance. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to bypass RabbitMQ authentication,” ZDI explains.
Both vulnerabilities were resolved with the release of Access Rights Manager version 2024.3.1. Users are advised to update their installations as soon as possible.
SolarWinds makes no mention of any of these vulnerabilities being exploited in the wild.
Related: SolarWinds Patches Critical Vulnerabilities in Access Rights Manager
Related: SolarWinds Web Help Desk Vulnerability Possibly Exploited as Zero-Day
Related: Ivanti Patches Critical Vulnerabilities in Endpoint Manager
Related: Zyxel Patches Critical Vulnerabilities in Networking Devices
