CVE-2021-35211
SolarWinds Serv-U Remote Code Execution Vulnerability
Description
CVE-2021-35211 is a critical-severity remote code execution vulnerability in SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows. The vulnerability exploits a remote memory escape (out-of-bounds write) flaw that allows threat actors to gain privileged access to the machine hosting Serv-U. Microsoft discovered this vulnerability being actively exploited as a zero-day by a threat actor. CISA has added CVE-2021-35211 to its Known Exploited Vulnerabilities catalog, and it is known to be used in ransomware campaigns. With an EPSS score of 94.24% (99.93rd percentile), this vulnerability poses an extreme risk to any organization running unpatched Serv-U instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | serv-u | < 15.2.3; 15.2.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit(Patch, Vendor Advisory)
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds write vulnerabilities occur when software writes data to a memory location outside the boundaries of an allocated buffer. In CVE-2021-35211, the Serv-U SSH implementation contains a memory escape vulnerability that allows an attacker to write beyond the intended memory boundaries, enabling arbitrary code execution with elevated privileges on the host system.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-35211 has been assigned CVSS scores ranging from 9.0 to 10.0 (CRITICAL), with NVD assigning the maximum score of 10.0, reflecting the catastrophic potential of this vulnerability. The attack is network-based and requires no authentication or user interaction, though the attack complexity is rated high, meaning specific conditions must be met for exploitation. Confidentiality (High): Successful exploitation grants attackers privileged access to the host system, exposing all stored data, transferred files, and system credentials. Integrity (High): Attackers can execute arbitrary code with elevated privileges, enabling installation of backdoors, malware, and data manipulation. Availability (High): Complete system compromise allows attackers to disrupt or destroy file transfer services. The scope is changed, meaning the exploitation can impact resources beyond the Serv-U application itself, extending to the underlying operating system and network. The confirmed use in ransomware campaigns and the EPSS score of 94.24% make this vulnerability an urgent priority for remediation.
Exploit Maturity
CVE-2021-35211 was discovered by Microsoft as an actively exploited zero-day vulnerability, with detailed findings published in their security blog. CISA has confirmed active exploitation by listing the vulnerability in the Known Exploited Vulnerabilities catalog, and it is known to be used in ransomware campaigns, significantly elevating the threat level. The EPSS score of 94.24% (99.93rd percentile) indicates near-certain exploitation activity. Federal agencies were required to remediate by 2021-11-17, reflecting the extreme urgency. The combination of zero-day exploitation by sophisticated threat actors and ransomware usage makes this one of the most dangerous vulnerabilities affecting file transfer solutions.
Remediation
- Apply SolarWinds Serv-U Hotfix 2 (version 15.2.3 HF2 or later) immediately as required by CISA KEV. Download the patch from the SolarWinds Trust Center.
- Upgrade all instances of SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows to version 15.2.3 HF2 or later. All versions prior to 15.2.3 HF2 are affected, including version 15.2.3 without the hotfix.
- If immediate patching is not possible, disable SSH access to the Serv-U server as the vulnerability is exploited through the SSH implementation. Restrict network access to Serv-U services to only trusted IP ranges using firewall rules.
- Conduct a thorough forensic investigation of all Serv-U servers to identify indicators of compromise, including unusual process execution, unauthorized file modifications, unexpected SSH connection patterns, and signs of ransomware deployment.
- Implement defense-in-depth measures including network segmentation to isolate file transfer servers, deploy endpoint detection and response (EDR) solutions on Serv-U hosts, and enable comprehensive logging to detect future exploitation attempts.
Technical Details
CVE-2021-35211 is a remote memory escape vulnerability (classified as CWE-787: Out-of-bounds Write) in the SSH implementation of SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows prior to version 15.2.3 HF2. The vulnerability allows a remote attacker to trigger an out-of-bounds write in memory, escaping the intended memory boundaries and achieving arbitrary code execution with elevated privileges. The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates the attack complexity as low with changed scope, while the vendor-assigned vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) considers the complexity high, reflecting the need for specific exploitation conditions. In both cases, no privileges or user interaction are required, and the scope change indicates that exploitation of the Serv-U application can lead to full compromise of the underlying operating system, making this an extremely dangerous vulnerability for any internet-exposed Serv-U deployment.
Frequently Asked Questions
Is CVE-2021-35211 being actively exploited?
Yes. CVE-2021-35211 was discovered by Microsoft as an actively exploited zero-day and is listed in the CISA Known Exploited Vulnerabilities catalog. It is confirmed to be used in ransomware campaigns. The EPSS score of 94.24% (99.93rd percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-35211?
CVE-2021-35211 affects SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows. All versions prior to 15.2.3 HF2 are vulnerable, including version 15.2.3 without Hotfix 2 applied.
How do I fix CVE-2021-35211?
Upgrade to SolarWinds Serv-U version 15.2.3 HF2 or later immediately. If patching is delayed, disable SSH access to the Serv-U server and restrict network access. Conduct forensic investigation of all Serv-U servers for signs of compromise.
How severe is CVE-2021-35211?
CVE-2021-35211 has CVSS scores of 9.0 to 10.0 (CRITICAL). The NVD assigns the maximum score of 10.0, reflecting the potential for full system compromise without authentication. Its use in ransomware campaigns and zero-day exploitation by sophisticated threat actors make it one of the most severe file transfer vulnerabilities requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.