2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1

Vulnerability

A vulnerability in SolarWinds Serv-U versions 15.4 and 15.4 Hotfix 1 allows an authenticated administrator-level user to bypass multi-factor authentication (MFA) or two-factor authentication (2FA). The flaw was not completely addressed in 15.4 Hotfix 1 [1].

Exploitation

To exploit the vulnerability, an attacker must already have administrator-level access to a Serv-U server. The specific steps required to trigger the bypass have not been disclosed in the available references [1].

Impact

Successful exploitation enables an administrator to bypass MFA/2FA protections, potentially allowing unauthorized access to the system with full administrative privileges. The CVSSv3.1 score of 6.6 (Medium) indicates high impacts on confidentiality, integrity, and availability, though exploitation requires high privileges and network access [1].

Mitigation

SolarWinds has released Serv-U 15.4 Hotfix 2 (HF2) to fully address this issue. Users are strongly advised to upgrade to version 15.4 HF2 or later. No workaround is documented [1].