Rapid7 Vulnerability & Exploit Database

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability

Back to Search

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability

Disclosed
03/13/2015
Created
05/30/2018

Description

This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the 'username' attribute before authentication. The second problem is that the settings-new.jsp file will only check the 'username' attribute before authorizing the 'uploadFile' action, which can be exploited and allows the attacker to upload a fake xls host list file to the server, and results in arbitrary code execution under the context of SYSTEM. Depending on the installation, by default the Change Advisor web server is listening on port 48080 for an express install. Otherwise, this service may appear on port 8080. Solarwinds has released a fix for this vulnerability as FSM-v6.6.5-HotFix1.zip, noted in the references for this module.

Author(s)

  • rgod
  • mr_me <steventhomasseeley@gmail.com>
  • sinn3r <sinn3r@metasploit.com>

Platform

Windows

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/http/solarwinds_fsm_userlogin
msf exploit(solarwinds_fsm_userlogin) > show targets
    ...targets...
msf exploit(solarwinds_fsm_userlogin) > set TARGET < target-id >
msf exploit(solarwinds_fsm_userlogin) > show options
    ...show and set options...
msf exploit(solarwinds_fsm_userlogin) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;