CVE-2015-2284
published 2015-03-24CVE-2015-2284: userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via…
PriorityP277critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
74.21%
99.4th percentile
userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| solarwinds | firewall_security_manager | <= 6.6.5 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect authentication bypass attempt: monitor for GET requests to /fsm/userlogin.jsp containing a 'username' query parameter, which abuses the session.putValue API to set session attributes before authentication. ↗
- →Detect exploitation of the file upload action: monitor for POST requests to /fsm/settings-new.jsp with query parameter action=uploadFile, especially with multipart/form-data content type containing a JSP file disguised as an XLS host list. ↗
- →Detect path traversal in uploaded filename: look for filenames containing '../../jsp/' in multipart upload requests to settings-new.jsp, indicating an attempt to write a JSP webshell outside the intended upload directory. ↗
- →Detect server-side error response indicating successful JSP payload upload: the server responds with a body containing 'java.lang.NoClassDefFoundError' when the JSP file is treated as XLS. ↗
- →Detect FSM Change Advisor web interface exposure: the login page returns the string 'SolarWinds FSM Change Advisor' in the response body; monitor for external access to /fsm/login.jsp on ports 48080 or 8080. ↗
- ·The default attack port is 48080 (express install), but the Change Advisor service may also run on port 8080 depending on installation type. Detection rules should cover both ports. ↗
- ·The exploit hardcodes 'admin' as the username for the session attribute injection, as this account exists by default and cannot be deleted. ↗
- ·The uploaded JSP payload is dropped into the jsp/ subdirectory via path traversal and executed by a subsequent GET request to /fsm/<filename>.jsp; the payload runs under SYSTEM context. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
SolarWinds Firewall Security Manager 6.6.5 - Client Session Handling (Metasploit)
exploitdb·2015-04-08
CVE-2015-2284 SolarWinds Firewall Security Manager 6.6.5 - Client Session Handling (Metasploit)
SolarWinds Firewall Security Manager 6.6.5 - Client Session Handling (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability",
'Description' => %q{
This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager
6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface
due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set
the 'username' attribute before authentication. The second problem is that the settings-new.jsp
file will only check the 'username' attribute before autho
Metasploit
Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability
metasploit
Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability
Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability
This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the 'username' attribute before authentication. The second problem is that the settings-new.jsp file will only check the 'username' attribute before authorizing the 'uploadFile' action, which can be exploited and allows the attacker to upload a fake xls host list file to the server, and results in arbitrary code execution under the context of SYSTEM. Depending on the installation, by default the Change Advisor web server is listening on
No writeups or analysis indexed.
2015-03-24
Published