SolarWinds Serv-U Zero-Day Enabled Targeted SSH-Based Remote Code Execution

SolarWinds patched a critical zero-day in Serv-U Managed File Transfer and Serv-U Secure FTP after active exploitation was discovered against a limited number of customers. The flaw, tracked as CVE-2021-35211, affects Serv-U deployments with SSH enabled and allows pre-authentication remote code execution when the SSH service is exposed to the internet. SolarWinds released Serv-U 15.2.3 HF2 and said the issue did not affect other SolarWinds or N-able products, including Orion, and was unrelated to the SUNBURST supply-chain compromise.

Microsoft said the attacks were limited and targeted, attributing them with high confidence to DEV-0322, a China-based threat group that targeted organizations including U.S. Defense Industrial Base entities and software companies. Microsoft’s analysis found the bug resided in Serv-U’s SSH implementation, where malformed SSH traffic could trigger use of uninitialized data as a function pointer during AES-CTR decryption; exploitation was aided by exception handling behavior and disabled ASLR in key modules, enabling reliable ROP chains. Post-exploitation activity included Serv-U.exe spawning mshta.exe, cmd.exe, and powershell.exe, writing command output to internet-accessible directories, and creating unauthorized global users, prompting both Microsoft and SolarWinds to publish detections, hunting guidance, and compromise indicators.