Security researchers have discovered three more vulnerabilities in SolarWinds products, including a critical remote code execution bug.
The IT management software provider has been in the news regularly over recent weeks after its Orion product was targeted by alleged Russian state hackers, in a major supply chain attack aimed at the US government.
A vulnerability patched in December was at the center of a new report this week claiming that Chinese state-sponsored threat actors exploited it as part of a cyber-espionage attack on a US federal payroll agency.
Now Trustwave is urging customers to address three “severe” flaws it found in SolarWinds products. The vendor fixed the issues promptly and there have been no reports of “in the wild” exploitation, but prompt patching is recommended.
Two of the software flaws are found in the SolarWinds Orion User Device Tracker and one is in the firm’s Serv-U FTP product.
The most critical vulnerability, CVE-2021-25274, is found in the former. It relates to the legacy Microsoft Message Queue (MSMQ) technology which is set up on installation, and could allow any remote unprivileged user to execute any arbitrary code with the highest privileges.
The second bug, CVE-2021-25275, affects the same product. Trustwave claimed that SolarWinds credentials are stored in an insecure manner which could allow local users to take complete control over the SOLARWINDS_ORION database. In so doing, they could steal data or add a new admin-level user inside SolarWinds Orion products, it said.
Finally, there’s CVE-2021-2527, in the SolarWinds Serv-U FTP for Windows product.
“Any local user, regardless of privilege, can create a file that can define a new Serv-U FTP admin account with full access to the C:\ drive. This account can then be used to login via FTP and read or replace any file on the drive,” explained Trustwave.
The security vendor said it is giving customers an extra week to patch before it releases proof-of-concept code.