Loading vulnerability…
CVE-2024-28995 is a directory traversal vulnerability in SolarWinds Serv-U. According to the provided content, the flaw is described as an 'InternalDir Directory Traversal' / 'directory transversal' issue that allows a remote attacker to access and read sensitive files on the underlying host machine by traversing paths outside the intended directory scope. Reporting cited in the content states the issue is trivially exploitable, can be exercised with publicly available proof-of-concept code, and may allow reading arbitrary files on disk if the attacker knows the target path and the file is not locked. Observed exploitation included attempts to read files such as /etc/passwd.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains a single Python exploit script (CVE-2024-28995.py) and a brief README. The script targets SolarWinds Serv-U Managed File Transfer Server version 15.4.2 HF1 and below, exploiting a directory traversal vulnerability (CVE-2024-28995). The exploit works by sending HTTP(S) requests with crafted file paths containing traversal sequences (e.g., '../') to the Serv-U web interface, allowing the attacker to read arbitrary files from the server's filesystem. The script supports both Windows and Linux targets, can process multiple targets from a file, and saves the results (including file contents) locally. It includes logic to detect the Serv-U version, determine the OS type based on file content, and provides a summary of vulnerable targets. The exploit is operational, providing real file read capability, and is not just a detection script. No hardcoded C2 or external network endpoints are present beyond the user-supplied target URLs.
This repository contains a working exploit for CVE-2024-28995, an unauthenticated directory traversal vulnerability in SolarWinds Serv-U File Server (versions 15.4.2 HF 1 and earlier). The exploit is implemented in Python (exploit.py) and allows an attacker to read arbitrary files from the target server's filesystem by sending crafted HTTP GET requests to the Serv-U web interface. The script first checks if the target is running on Windows or Linux by attempting to read known files, then allows the user to specify any file path to extract. The README.md provides background, usage instructions, affected versions, and references. The main attack vector is network-based, targeting the HTTP(S) interface of Serv-U. The exploit is operational, requiring only the target URL and no authentication. Notable endpoints include the vulnerable HTTP parameters (InternalDir and InternalFile) and example file paths such as /etc/passwd and /windows/win.ini.
This repository contains a Python exploit for CVE-2024-28995, a directory traversal vulnerability in SolarWinds Serv-U. The main file, CVE-2024-28995.py, is a command-line tool that allows the user to target a single URL or a list of domains. It attempts to exploit the vulnerability by sending crafted HTTP GET requests with manipulated InternalDir and InternalFile parameters, aiming to read sensitive files such as /etc/passwd (Linux), win.ini, or Serv-U-StartupLog.txt (Windows) from the target server. The exploit checks the response for known file content indicators to confirm success. The code supports multi-threaded scanning for lists of targets. The repository also includes a README.md with usage instructions and a requirements.txt listing dependencies (requests, colorama, urllib3). The exploit is operational and demonstrates the vulnerability by reading arbitrary files, but does not provide a post-exploitation payload.
This repository contains a Python proof-of-concept exploit for CVE-2024-28995, a path traversal and local file read vulnerability in SolarWinds Serv-U (version 15.4.2 and below). The main script, CVE-2024-28995.py, allows an attacker to check if a target Serv-U instance is vulnerable by retrieving the version from the HTTP Server header, and then attempts to exploit the vulnerability by sending crafted HTTP GET requests with manipulated InternalDir and InternalFile parameters. The script supports reading default sensitive files on both Windows and Linux, as well as custom file paths and wordlist-based brute-forcing. The exploit is network-based and requires the attacker to have access to the Serv-U web interface. The repository is structured simply, with one main exploit script and a README providing usage instructions and references.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A path traversal vulnerability in SolarWinds Serv-U mentioned as another historically exploited Serv-U issue that may coexist on unpatched systems.
A trivially exploitable vulnerability that was leveraged by attackers.
A SolarWinds Serv-U path-traversal vulnerability reported by GreyNoise and Rapid7 as actively exploited.
A prior SolarWinds Serv-U vulnerability referenced as having been exploited by malicious actors (details not provided in the content).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.