SolarWinds released patches for eight high-severity vulnerabilities in its Access Rights Manager (ARM) software. Three of the vulnerabilities (CVE-2023-35182, CVE-2023-35185, and CVE-2023-35187) were remote code execution flaws susceptible to exploitation by unauthenticated users.
The first remote code execution vulnerability existed due to improper data validation in the createGlobalServerChannelInternal method, which produced deserialized untrusted data. The other remote code execution vulnerabilities existed due to improper validation of user-supplied paths prior to using the OpenFile and OpenClientUpdateFile methods in file operations. An actor without authentication could have leveraged the bugs to execute arbitrary code with System privileges. The other flaws patched in Access Rights Manager 2023.2.1 required authentication to exploit.
Read More:
