Cross-Site Scripting Vulnerability in Serv-U Web Client

Vulnerability

The vulnerability exists in the directory creation function of the SolarWinds Serv-U web client, affecting versions 15.3.0 through 15.3.1. The flaw allows improper validation of directory creation requests, potentially enabling an attacker to create directories in unintended locations.

Exploitation

An attacker with network access to the web client interface could exploit this vulnerability by sending specially crafted requests to the directory creation function. The exact prerequisites, such as authentication status, are not detailed in the available references [1].

Impact

Successful exploitation could allow an attacker to create arbitrary directories on the server, potentially leading to further attacks such as file upload or information disclosure. The specific impact scope is defined by the server's file system permissions.

Mitigation

SolarWinds has released security updates to address this vulnerability. Users should upgrade to a fixed version as recommended in the official advisory [1]. No workaround is provided. Check the advisory for the specific patched version.