Active Exploitation of SolarWinds Serv-U File Disclosure Flaw CVE-2024-28995
Active Exploitation · 5 sources · Updated 3mo ago · First seen Jun 25, 2024
SolarWinds disclosed CVE-2024-28995, a high-severity directory traversal and local file disclosure flaw in its Serv-U managed file transfer software that affects versions earlier than 15.4.2 Hotfix 2. The vulnerability can be exploited remotely and without authentication via crafted HTTP GET requests, allowing attackers to read arbitrary files from the host system, including sensitive material such as credentials, certificates, and configuration data. Rapid7 described the issue as trivially exploitable, and SolarWinds issued fixes through Serv-U 15.4.2 HF2, with deployment requiring 15.4.2 HF1 first.
Security researchers and national defenders reported that exploitation began quickly after disclosure. GreyNoise observed internet-wide exploitation activity targeting exposed Serv-U instances, while CSIRT.SK warned that public scanning tools and proof-of-concept exploit code were increasing the likelihood of opportunistic attacks. The combination of unauthenticated access, straightforward exploitation, and the ability to extract sensitive files has made patching exposed Serv-U servers an urgent priority.
