Execute Command Function Allows Remote Code Execution (RCE)Vulnerability

Vulnerability

SolarWinds Serv-U File Server versions prior to the fix for CVE-2021-35223 allow the audit of events (such as user login failures) by executing a configured command. The command can be supplied with parameters that use user string variables, enabling remote code execution when an attacker-controlled string is processed by the command execution feature [1].

Exploitation

An attacker with network access to the Serv-U FTP/FTPS/SFTP service can cause a login failure that includes a crafted string in the username or other user-provided field. The audit action executing the external command processes this string as a command parameter, resulting in arbitrary command execution [1].

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands in the context of the Serv-U service, leading to full compromise of the affected server [1].

Mitigation

SolarWinds has released a hotfix for Serv-U File Server. Affected users should apply the update as provided in the security advisory [1]. No workarounds were published; upgrading to the fixed version is the recommended remediation.