KL-001-2017-016 : Solarwinds LEM Insecure Update Process Title: Solarwinds LEM Insecure Update Process Advisory ID: KL-001-2017-016 Publication Date: 2017.09.25 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-016.txt 1. Vulnerability Details Affected Vendor: Solarwinds Affected Product: Multiple Affected Version: Multiple Platform: Embedded Linux CWE Classification: CWE-284: Improper Access Control, CWE-346: Origin Validation Error Impact: Counterfeit Product Downloads Attack vector: HTTP 2. Vulnerability Description Software updates for Solarwinds products are packaged and delivered insecurely, leading to root compromise of Solarwinds devices. 3. Technical Description Software updates for Solarwinds products are typically downloaded via plaintext HTTP links, consisting of a .zip file with no corresponding PGP signature or even SHA256 checksum. An attacker able to redirect, phish, or man-in-the-middle downloads of update files could plant backdoors in Solarwinds systems. If Solarwinds device administrators are permitted to initiate upgrades but not granted root shell access (such as via a restricted management shell only), this can also be used to elevate privileges to gain unrestricted root access. Some examples from official Solarwinds forums and support pages: https://thwack.solarwinds.com/thread/111223 points to http://downloads.solarwinds.com/solarwinds/Release/HotFix/SolarWinds-LEM-v6.3.1-Hotfix4.zip, which includes some data files and a perl script, hotfix/apply_hotfix. https://support.solarwinds.com/Success_Center/Storage_Manager_(STM)/Storage_Manager_and_Storage_Resource_Monitor_Profiler_Agent_download_links -> http://downloads.solarwinds.com/solarwinds/Release/StorageManager/6.0.0/Storage_Manager_Agent-linux-x86_64-6.0.zip (and many others), which contains a single .bin file that is a shell script with an embedded compressed .tar file. https://support.solarwinds.com/Success_Center/Storage_Manager_(STM)/SRM_Profiler_6.2.3_Hotfix_1 -> http://downloads.solarwinds.com/solarwinds/Release/HotFix/STM-v6.2.3-HotFix1.zip, which contains data files and driver scripts for both Linux (Patch/STM_Patch.sh) and Windows (Patch/STM Patch.bat). https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/AIX_Agent_Communication_error -> http://downloads.solarwinds.com/solarwinds/Release/LEM/SolarWinds-LEM-v5.3.1-AIXAgentInstaller.zip, contains a single .bin file that is a shell script with an embedded compressed .tar file. Windows-centric software is also accessed via HTTP links, and consist of .zip files containing .exe files. No analysis was done to check if these .exe's are signed, etc., although a user could likely be duped into running an an executable without a signature or signed by a bogus certificate. http://downloads.solarwinds.com/ is Akamai-hosted, and attempting to force HTTPS results in a certificate name mismatch (i.e. customers cannot simply elect to use a less insecure download URL). 4. Mitigation and Remediation Recommendation The vendor has addressed these issues and provided the following statement: We have obtained digital certificates for our download webpages and have updated our URL links accordingly to HTTPS. Additionally, we have already enabled checksums for many of our products on our federal sites and are working towards publishing checksums on our commercial download pages. 5. Credit This vulnerability was discovered by Hank Leininger of KoreLogic, Inc. 6. Disclosure Timeline 2017.08.11 - KoreLogic submits vulnerability report to Solarwinds contact. 2017.08.16 - Solarwinds acknowledges receipt of the report. 2017.08.18 - Solarwinds informs KoreLogic they will begin working on remediation. 2017.09.07 - Solarwinds informs KoreLogic the issues have been addressed and provides the statement that appears in section 4 of this advisory. 2017.09.25 - KoreLogic public disclosure. 7. Proof of Concept See 3. Technical Description The contents of this advisory are copyright(c) 2017 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/ KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html Our public vulnerability disclosure policy is available at: https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt