Domain Admin Broken Access Control

Vulnerability

A broken access control vulnerability exists in SolarWinds Serv-U versions 15.3 and earlier [1]. A domain administrator can access configuration and user data of other domains that they should not have access to. The admin is unable to modify the data (read-only operation) but can view sensitive information [1].

Exploitation

An authenticated domain administrator can exploit this flaw by leveraging their existing permissions to access data belonging to other domains. The attacker must have domain admin privileges within the Serv-U environment. The read-only activity is logged to the original domain but does not specify which domain was accessed, only logging the activity if the user attempts to modify data [1]. No user interaction is required beyond the initial authentication.

Impact

Successful exploitation leads to a data leak of configuration and user data from unauthorized domains. The attacker gains read access to sensitive information they should not have, resulting in a breach of confidentiality. There is no impact on integrity or availability, as the operation is read-only [1].

Mitigation

The vulnerability is fixed in Serv-U version 15.3.1, released on the same date as the advisory (May 17, 2022) [1]. Users should upgrade to version 15.3.1 or later. No workarounds are provided in the available references.