CVE-2018-19934

Vulnerability

SolarWinds Serv-U FTP Server version 15.1.6.25 contains a reflected cross-site scripting (XSS) vulnerability in the Web management interface. The injection points include the URL path, specifically /Admin/XML and /Admin/XML/Result.xml, and the HTTP POST parameter SMTPServer in /Admin/XML/SMTPResult.xml [1].

Exploitation

An attacker can craft a malicious URL or POST request containing a JavaScript payload in the vulnerable parameter. The management interface reflects the input without proper sanitization when processing the request. No authentication is required for the reflection, but the crafted link must be sent to a user who is currently authenticated to the management interface (e.g., via phishing) for the XSS to execute in the user's session [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session on the management interface. This can lead to session hijacking, defacement, or theft of sensitive data displayed in the interface [1].

Mitigation

The vulnerability was fixed in Serv-U version 15.1.6 hotfix 3, released by SolarWinds. Administrators should upgrade to the patched version immediately [1].