ExploitPublished 29 May 2025

SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal

Source Exploit-DB RSS Feed

Mentioned vulnerabilities

CVE-2024-28995

Severity

Medium

Rated by Threat Radar

Data as of 11 Jun 2025, 21:16 UTC

What to do

AI-suggested

Immediate upgrade: European organizations should prioritize upgrading SolarWinds Serv-U to versions later than 15.4.2 HF1, where this vulnerability is patched. Contact SolarWinds support or check official advisories for the latest secure versions.
Network segmentation: Restrict access to Serv-U servers by placing them behind firewalls and VPNs, limiting exposure to trusted internal networks only.
Web application firewall (WAF): Deploy WAF rules to detect and block suspicious requests containing directory traversal patterns targeting 'InternalDir' and 'InternalFile' parameters.
Monitoring and logging: Enhance monitoring of HTTP requests to Serv-U servers for anomalous patterns indicative of directory traversal attempts and implement alerting.
Disable unnecessary services: If Serv-U is not essential, consider disabling or uninstalling it to reduce attack surface.
Incident response preparation: Prepare to analyze and respond to potential breaches by reviewing logs and scanning for indicators of compromise related to this vulnerability.
Custom payload blocking: Implement input validation and filtering on the Serv-U server or reverse proxy to reject requests with suspicious traversal sequences.
Regular vulnerability scanning: Use updated scanning tools that include checks for CVE-2024-28995 to identify vulnerable instances proactively. These measures go beyond generic advice by focusing on immediate patching, network-level protections, and active detection tailored to the specific exploit vectors used by this vulnerability.

Description

SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal

Impact

For European organizations, this vulnerability poses a significant risk to confidentiality and potentially integrity of critical data managed by SolarWinds Serv-U servers. Many enterprises and government agencies in Europe rely on Serv-U for secure file transfers, including sensitive personal data protected under GDPR, intellectual property, and internal logs. Unauthorized access to configuration files and user account data could facilitate lateral movement, privilege escalation, or targeted attacks. The ability to read system files may also reveal system configurations and credentials, increasing the risk of further compromise. Given the exploit requires no authentication and can be executed remotely, exposed Serv-U servers in Europe could be rapidly targeted by attackers, including cybercriminals and state-sponsored actors. This could lead to data breaches, regulatory penalties, and reputational damage. Additionally, the exposure of log files might reveal operational details that could be leveraged for more sophisticated attacks. The medium severity rating reflects the absence of direct remote code execution but acknowledges the criticality of information disclosure in sensitive environments.

Indicators of compromise

Exploit source code

Exploit code for SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal18,331 characters

# Exploit Title: SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal 
# Date: 2025-05-28
# Exploit Author: @ibrahimsql
# Exploit Author's github: https://github.com/ibrahimsql
# Vendor Homepage: https://www.solarwinds.com/serv-u-managed-file-transfer-server
# Software Link: https://www.solarwinds.com/serv-u-managed-file-transfer-server/registration
# Version: <= 15.4.2 HF1
# Tested on: Kali Linux 2024.1
# CVE: CVE-2024-28995
# Description:
# SolarWinds Serv-U was susceptible to a directory traver…

References

Community reviews

Loading reviews…