CVE-2018-19999

Vulnerability

The local management interface in SolarWinds Serv-U FTP Server version 15.1.6.25 and earlier has incorrect access controls that permit local users to bypass authentication. This vulnerability requires the attacker to have local access to the host and a Serv-U administrator to have an active management console session [1].

Exploitation

An attacker with local access to the Serv-U server can exploit the broken access controls to bypass authentication. The attacker must have a local user account on the Windows host, and a Serv-U administrator must have an active management console session. The exact exploitation steps are not detailed in the reference, but the authentication bypass allows arbitrary code execution [1].

Impact

Successful exploitation allows the attacker to execute code in the context of the Windows SYSTEM account, resulting in complete compromise of the affected system (privilege escalation from local user to SYSTEM). This leads to full control over the host [1].

Mitigation

The vulnerability is fixed in Serv-U FTP Server version 15.1.7. Users should upgrade to this version or later. No workarounds are mentioned in the available references [1].