SolarWinds Serv-U Management Console Path Traversal

This repository contains a single Python exploit script (CVE-2024-28995.py) and a brief README. The script targets SolarWinds Serv-U Managed File Transfer Server version 15.4.2 HF1 and below, exploiting a directory traversal vulnerability (CVE-2024-28995). The exploit works by sending HTTP(S) requests with crafted file paths containing traversal sequences (e.g., '../') to the Serv-U web interface, allowing the attacker to read arbitrary files from the server's filesystem. The script supports both Windows and Linux targets, can process multiple targets from a file, and saves the results (including file contents) locally. It includes logic to detect the Serv-U version, determine the OS type based on file content, and provides a summary of vulnerable targets. The exploit is operational, providing real file read capability, and is not just a detection script. No hardcoded C2 or external network endpoints are present beyond the user-supplied target URLs.

This repository contains a single Metasploit auxiliary module that exploits CVE-2024-28995, an unauthenticated arbitrary file read vulnerability in SolarWinds Serv-U FTP Server, Gateway, and MFT Server (all versions prior to 15.4.2.157). The exploit leverages a directory traversal flaw in the web interface, allowing remote attackers to read arbitrary files from the server's filesystem by sending crafted HTTP GET requests. The module allows the user to specify the file path to read and the number of directory traversal segments, making it adaptable to different server configurations. The exploit is operational and can be used to exfiltrate sensitive files from vulnerable servers. The code is written in Ruby and is designed to be run within the Metasploit Framework. No payload is delivered beyond the file read, and the exploit does not require authentication. The module also includes logic to check for vulnerability by attempting to read known log files and extract version information. The repository is well-structured, containing only the exploit module, and is focused solely on this vulnerability.

This repository contains a working exploit for CVE-2024-28995, an unauthenticated directory traversal vulnerability in SolarWinds Serv-U File Server (versions 15.4.2 HF 1 and earlier). The exploit is implemented in Python (exploit.py) and allows an attacker to read arbitrary files from the target server's filesystem by sending crafted HTTP GET requests to the Serv-U web interface. The script first checks if the target is running on Windows or Linux by attempting to read known files, then allows the user to specify any file path to extract. The README.md provides background, usage instructions, affected versions, and references. The main attack vector is network-based, targeting the HTTP(S) interface of Serv-U. The exploit is operational, requiring only the target URL and no authentication. Notable endpoints include the vulnerable HTTP parameters (InternalDir and InternalFile) and example file paths such as /etc/passwd and /windows/win.ini.

This repository contains a Python exploit for CVE-2024-28995, a directory traversal vulnerability in SolarWinds Serv-U. The main file, CVE-2024-28995.py, is a command-line tool that allows the user to target a single URL or a list of domains. It attempts to exploit the vulnerability by sending crafted HTTP GET requests with manipulated InternalDir and InternalFile parameters, aiming to read sensitive files such as /etc/passwd (Linux), win.ini, or Serv-U-StartupLog.txt (Windows) from the target server. The exploit checks the response for known file content indicators to confirm success. The code supports multi-threaded scanning for lists of targets. The repository also includes a README.md with usage instructions and a requirements.txt listing dependencies (requests, colorama, urllib3). The exploit is operational and demonstrates the vulnerability by reading arbitrary files, but does not provide a post-exploitation payload.

This repository contains a Python proof-of-concept exploit for CVE-2024-28995, a path traversal and local file read vulnerability in SolarWinds Serv-U (version 15.4.2 and below). The main script, CVE-2024-28995.py, allows an attacker to check if a target Serv-U instance is vulnerable by retrieving the version from the HTTP Server header, and then attempts to exploit the vulnerability by sending crafted HTTP GET requests with manipulated InternalDir and InternalFile parameters. The script supports reading default sensitive files on both Windows and Linux, as well as custom file paths and wordlist-based brute-forcing. The exploit is network-based and requires the attacker to have access to the Serv-U web interface. The repository is structured simply, with one main exploit script and a README providing usage instructions and references.