CVE-2021-35247
SolarWinds Serv-U Improper Input Validation Vulnerability
Description
CVE-2021-35247 is a MEDIUM severity improper input validation vulnerability (CWE-20) in SolarWinds Serv-U file transfer software, affecting versions 15.2.5 and earlier. The vulnerability exists in the Serv-U login screen, where the web interface fails to properly validate user input, allowing an attacker to build and send queries without sanitization. With a CVSS 3.1 score of 4.3, the vulnerability requires network access and some user interaction to exploit, and primarily impacts integrity rather than confidentiality or availability. CISA added CVE-2021-35247 to its Known Exploited Vulnerabilities catalog on January 21, 2022, with an unusually short remediation deadline of February 4, 2022, indicating particular urgency. The EPSS score of 0.03182 (86.78th percentile) reflects moderate exploitation probability, and the vulnerability was fixed in Serv-U version 15.3.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | serv-u | < 15.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm(Release Notes, Vendor Advisory)
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation is a fundamental software weakness where an application receives user input but fails to validate that the input conforms to expected formats, types, lengths, or ranges before processing it. When applications accept unvalidated input, attackers can supply malicious, malformed, or unexpected data to alter program behavior, bypass security controls, or trigger unintended operations. Input validation failures are the root cause of many critical vulnerability classes including SQL injection, cross-site scripting, command injection, and LDAP injection.
In CVE-2021-35247, the SolarWinds Serv-U web login screen does not properly validate user-supplied input before incorporating it into backend queries. Specifically, the authentication form accepts input that should be restricted to valid credential formats but instead allows the construction of unsanitized queries that are sent to backend systems. This improper validation in the login interface allows an attacker to craft inputs that are interpreted differently by the backend query processor than intended by the application logic. While the CVSS score reflects a moderate severity, the vulnerability's inclusion in CISA's KEV catalog with an aggressive two-week remediation deadline indicates that the flaw was actively exploited in targeted campaigns, likely as part of the broader series of SolarWinds-related security incidents. Learn more about Improper Input Validation (CWE-20)
Impact Analysis
CVE-2021-35247 carries a CVSS 3.1 base score of 4.3 (MEDIUM) with a limited but significant impact profile.
Confidentiality (None): The CVSS assessment rates the confidentiality impact as None. The input validation bypass in the Serv-U login screen does not directly expose stored data or allow the attacker to read files or credentials from the server. However, the ability to send unsanitized queries to backend systems could potentially be leveraged in conjunction with other vulnerabilities to achieve information disclosure, depending on the backend system's response behavior.
Integrity (Low): The primary impact of CVE-2021-35247 is on integrity, rated as Low. The vulnerability allows an attacker to send improperly crafted queries through the Serv-U login interface that bypass the intended input validation. This can result in the backend processing unexpected or malicious query content, potentially altering query logic or affecting the authentication process. While the direct integrity impact is limited, the ability to inject unsanitized input into backend queries represents a significant security boundary violation.
Availability (None): The vulnerability does not directly impact the availability of the Serv-U service. The unsanitized queries processed through the login screen do not cause service crashes or resource exhaustion under normal exploitation conditions.
Scope (Unchanged): The scope remains within the Serv-U application and its immediate backend systems. However, given the context of SolarWinds products being high-value targets for sophisticated threat actors, even a medium-severity vulnerability in this software warrants urgent attention. The EPSS score of 0.03182 (86.78th percentile) indicates exploitation probability well above average, consistent with the confirmed active exploitation that prompted KEV inclusion.
Exploit Maturity
Active Exploitation: CVE-2021-35247 is confirmed as actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on January 21, 2022, with a notably aggressive remediation deadline of February 4, 2022 (only two weeks), indicating heightened urgency and active targeting by threat actors. The short deadline contrasts with the typical six-month window for many KEV entries.
Ransomware Association: The CISA KEV catalog does not associate CVE-2021-35247 with known ransomware campaigns. The vulnerability's exploitation appears to be focused on targeted intelligence-gathering campaigns rather than broad ransomware distribution.
Public Exploits: SolarWinds documented the vulnerability and its fix in the Serv-U 15.3 release notes. The SolarWinds Trust Center advisory provides additional details. While specific public exploit code is not as widely available as for critical RCE vulnerabilities, the exploitation techniques are well understood by the threat actors targeting SolarWinds products.
EPSS Context: The EPSS score of 0.03182 (86.78th percentile) is moderate compared to the other CVEs in this batch but still places the vulnerability in the top 13.2% of all CVEs for exploitation probability. This reflects confirmed active exploitation despite the moderate CVSS score.
KEV Deadline: The extremely short CISA remediation deadline of February 4, 2022 (just two weeks from the January 21 KEV addition) underscores the urgency. Organizations running SolarWinds Serv-U must apply the update immediately.
Remediation
-
Update SolarWinds Serv-U to version 15.3 or later. Download and install the patched version from the official SolarWinds release notes page. Version 15.3 addresses the input validation vulnerability in the login screen by implementing proper sanitization of user-supplied input before it reaches backend query processing.
-
Review Serv-U access logs for suspicious authentication attempts. Examine login logs for unusual patterns that may indicate exploitation attempts, such as malformed usernames, unexpected special characters in login fields, or authentication attempts with query syntax in the credential fields. Correlate suspicious entries with source IP addresses to identify potential threat actors.
-
Restrict network access to the Serv-U management interface. Limit access to the Serv-U web login interface to trusted IP ranges using firewall rules or the Serv-U built-in access control features. Do not expose the Serv-U management interface directly to the public internet without VPN or IP restriction.
-
Implement multi-factor authentication for Serv-U access. Add an additional authentication layer beyond username and password to mitigate the risk of authentication bypass through input manipulation. MFA significantly reduces the impact of login-level vulnerabilities.
-
Monitor for SolarWinds security advisories proactively. Given the history of sophisticated attacks targeting SolarWinds products (including the 2020 SUNBURST supply chain attack), maintain heightened vigilance for new SolarWinds advisories and apply patches within the shortest possible timeframe. Subscribe to the SolarWinds Trust Center notifications.
-
Conduct a broader SolarWinds security review. CVE-2021-35247 exists in the context of multiple SolarWinds vulnerabilities that have been targeted by advanced threat actors. Review all SolarWinds products in your environment for current patch status, verify the integrity of installed software, and assess whether network segmentation adequately isolates SolarWinds infrastructure from critical assets.
Technical Details
CVE-2021-35247 is an improper input validation vulnerability in the web-based login screen of SolarWinds Serv-U versions 15.2.5 and earlier. The Serv-U file transfer server provides a web interface for authentication and file management, and the login form processes user-supplied credentials through backend query mechanisms to verify authentication.
The vulnerability exists because the login screen's input handling does not properly sanitize or validate the format of user-supplied values before incorporating them into backend queries. An attacker can craft input in the username or other login form fields that includes characters or syntax elements that are meaningful to the backend query processor but should have been stripped or escaped by the input validation layer. This allows the attacker to construct and send queries that were not intended by the application design.
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates the attack is network-based with low complexity and no authentication required, but some user interaction is needed. The impact is limited to low integrity with no confidentiality or availability impact. The user interaction requirement suggests the attacker may need to direct a user to a crafted URL or rely on specific browser behavior to complete the exploitation.
While the CVSS score is moderate at 4.3, the context of this vulnerability within the SolarWinds product ecosystem is significant. SolarWinds products have been high-priority targets for nation-state threat actors since the SUNBURST incident, and any vulnerability in SolarWinds software that enables input manipulation in authentication flows represents a valuable attack primitive. The fix in Serv-U 15.3 implements proper input validation and sanitization for the login screen, ensuring that user-supplied input cannot be used to construct unsanitized backend queries.
Frequently Asked Questions
What is CVE-2021-35247?
CVE-2021-35247 is an improper input validation vulnerability in the web login screen of SolarWinds Serv-U file transfer software (versions 15.2.5 and earlier). The vulnerability allows attackers to send unsanitized queries through the login interface because user input is not properly validated before being processed by backend systems. While rated MEDIUM with a CVSS score of 4.3, it was added to CISA's KEV catalog with an unusually short two-week remediation deadline.
Which SolarWinds products are affected by CVE-2021-35247?
SolarWinds Serv-U versions 15.2.5 and earlier are affected. Serv-U is a managed file transfer (MFT) server used by organizations for secure file transfer operations. The vulnerability is in the web-based login interface, which is the primary authentication mechanism for Serv-U users and administrators. The fix is available in Serv-U version 15.3 and later.
How do I fix CVE-2021-35247?
Update SolarWinds Serv-U to version 15.3 or later, which adds proper input validation to the login screen. After updating, review authentication logs for signs of prior exploitation, restrict network access to the Serv-U interface, and implement multi-factor authentication as an additional security layer. Given the sensitive nature of SolarWinds products, apply this update with the highest priority.
How severe is CVE-2021-35247?
CVE-2021-35247 is rated MEDIUM with a CVSS 3.1 score of 4.3, the lowest severity in this batch. However, its inclusion in CISA's KEV catalog with just a two-week remediation deadline indicates confirmed active exploitation and heightened urgency. The EPSS score of 0.03182 (86.78th percentile) is above average. In the context of the broader SolarWinds threat landscape and the targeting of SolarWinds products by sophisticated threat actors, even medium-severity vulnerabilities warrant immediate attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.