{"id":7578,"date":"2020-12-15T21:15:11","date_gmt":"2020-12-16T04:15:11","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7578"},"modified":"2024-04-24T10:54:04","modified_gmt":"2024-04-24T17:54:04","slug":"vulnerability-analysis-solarwinds-orion-network-management","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/vulnerability-analysis-solarwinds-orion-network-management\/","title":{"rendered":"Vulnerability Analysis: SolarWinds Orion Network Management"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7578\" class=\"elementor elementor-7578\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-75d24e25 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"75d24e25\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-36ab2f5d\" data-id=\"36ab2f5d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3e526bc elementor-widget elementor-widget-text-editor\" data-id=\"3e526bc\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<blockquote><p style=\"text-align: left;\"><strong><span style=\"color: #000000;\">The SolarWinds Orion Platform Software is a Network Management tool that is widely used by over 300,000 customers worldwide. Entities like defense, government agencies, software companies, and Fortune 500 organizations use this platform to monitor IT stack from infrastructure to application. SolarWinds confirmed in its <\/span><a href=\"https:\/\/www.solarwinds.com\/sa-overview\/securityadvisory\" target=\"_blank\" rel=\"noopener\">security advisory<\/a> <span style=\"color: #000000;\">that Orion update versions 2019.4 through 2020.2.1, released between March 2020 and June 2020, have been infected with malware known as SUNBURST\/Solorigate.<\/span><\/strong><\/p><\/blockquote>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f9e9a3a elementor-widget elementor-widget-text-editor\" data-id=\"f9e9a3a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: left;\">Security agencies in the US are in a panic because SolarWinds is a widely used and popular product. Here are a few details that would help you understand the gravity of this breach.<\/span><\/p>\n<p style=\"text-align: left;\"><strong><span style=\"color: #000000;\">Orion is used by the following:<\/span><\/span><\/strong><\/p>\n\n<ul dir=\"ltr\" style=\"text-align: left;\">\n \t<li role=\"presentation\">425+ US Fortune 500 companies<\/li>\n \t<li role=\"presentation\">Top ten US telecommunication companies<\/li>\n \t<li role=\"presentation\">All five branches of the US military<\/li>\n \t<li role=\"presentation\">The US Pentagon, State Department, NASA, NSA, Postal Service, NOAA, Department of Justice, and the Office of the President of the United States<\/li>\n \t<li role=\"presentation\">Top five US accounting firms<\/li>\n \t<li role=\"presentation\">Hundreds of universities and colleges worldwide<\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-de39ec3 elementor-widget elementor-widget-spacer\" data-id=\"de39ec3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cb0f2b1 elementor-widget elementor-widget-heading\" data-id=\"cb0f2b1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\u200b\u200b\u200bSecurin's Insights and Key Findings<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f2ae00c elementor-widget elementor-widget-text-editor\" data-id=\"f2ae00c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: left;\">A breach of this magnitude calls for a closer look. Here are a few key points from Securin\u2019s Attack Surface analysis on known vulnerabilities and what has been weaponized to date.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-cf9186a elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"cf9186a\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-88aa725\" data-id=\"88aa725\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5109832 elementor-widget elementor-widget-text-editor\" data-id=\"5109832\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"text-align: left;\">There are 102 vulnerabilities that exist in SolarWinds, out of which 15 are present in the Orion Platform Software.<\/p>\n\n<ol dir=\"ltr\" style=\"text-align: justify;\">\n \t<li style=\"text-align: left;\" role=\"presentation\">4 CVEs are rated as critical, 1 as high, and 9 as medium.<\/li>\n \t<li style=\"text-align: left;\" role=\"presentation\">11 are old vulnerabilities ranging from years 2010 to 2019.<\/li>\n \t<li style=\"text-align: left;\" role=\"presentation\"><a href=\"https:\/\/support.solarwinds.com\/SuccessCenter\/s\/article\/CVE-2019-9546-Orion-Platform-Vulnerability?language=en_US\" target=\"_blank\" rel=\"noopener\">CVE-2019-9546<\/a>, a critical Privilege Execution vulnerability, is suspected to be the culprit that allowed this breach. There are <a href=\"https:\/\/www.activecyber.us\/activelabs\/solarwinds-local-privilege-escalation-cve-2019-9546\" target=\"_blank\" rel=\"noopener\">well-known exploits<\/a> for this vulnerability.<\/li>\n \t<li style=\"text-align: left;\" role=\"presentation\">Analysis of Common Weakness Enumeration reveals that CWE-79 (Improper Neutralization of Input during Web Page Generation) is popularly used to exploit Orion\u2019s vulnerabilities.<\/li>\n \t<li style=\"text-align: left;\" role=\"presentation\">We found no publicly associated APT groups and ransomware with these 15 vulnerabilities at the time of writing this analysis.<\/li>\n<\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-7fbcb07\" data-id=\"7fbcb07\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-99eaa92 elementor-widget elementor-widget-image\" data-id=\"99eaa92\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"1424\" height=\"1080\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-funnel.png\" class=\"attachment-full size-full wp-image-20630\" alt=\"\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-funnel.png 1424w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-funnel-300x228.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-funnel-1024x777.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-funnel-768x582.png 768w\" sizes=\"(max-width: 1424px) 100vw, 1424px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<div class=\"elementor-element elementor-element-0a89b21 elementor-widget elementor-widget-spacer\" data-id=\"0a89b21\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-afd6f62 elementor-widget elementor-widget-heading\" data-id=\"afd6f62\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Did the Attack Unfold?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5cbe63b elementor-widget elementor-widget-text-editor\" data-id=\"5cbe63b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>SolarWinds&#8217; security advisory revealed that it was compromised early in 2020, but there is reasonable doubt to surmise that it might have been attacked as early as 2019 when the FTP credentials of SolarWinds were leaked onto GitHub.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-afd0f01 elementor-widget elementor-widget-image\" data-id=\"afd0f01\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"1044\" height=\"727\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/printscreen1.png\" class=\"attachment-full size-full wp-image-20631\" alt=\"\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/printscreen1.png 1044w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/printscreen1-300x209.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/printscreen1-1024x713.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/printscreen1-768x535.png 768w\" sizes=\"(max-width: 1044px) 100vw, 1044px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6355ca0 elementor-widget elementor-widget-text-editor\" data-id=\"6355ca0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: left;\">SolarWinds, however, maintains that the threat actors installed a backdoor to a key library in early 2020. This library was then delivered to select customers through their normal updating process. This led to SolarWinds Orion versions 2019.4 through 2020.2.1 HF1 being potentially affected. As an IT management platform, this backdoor provides a perfect getaway to an attacker who can enable or disable security tools and configurations or prevent patch applications that would mitigate the risk of these vulnerabilities.\u00a0<\/span><\/span><\/p>\n<p dir=\"ltr\" style=\"text-align: left;\">Here is a MITRE map of how this attack might have unfolded:<\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bc6f5d1 elementor-widget elementor-widget-image\" data-id=\"bc6f5d1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"1200\" height=\"628\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-attack-chain-image_revised.png\" class=\"attachment-full size-full wp-image-20636\" alt=\"\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-attack-chain-image_revised.png 1200w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-attack-chain-image_revised-300x157.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-attack-chain-image_revised-1024x536.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2020\/12\/solarwinds-attack-chain-image_revised-768x402.png 768w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6484b0f elementor-widget elementor-widget-spacer\" data-id=\"6484b0f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4229fcaf elementor-widget elementor-widget-text-editor\" data-id=\"4229fcaf\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"text-align: left;\">Our exposure analysis identified 1,687 internet-facing SolarWinds&#8217; products; 699 are from the US, and 56 are from India. Network Management Tools should never be exposed to the internet. Incidentally, Securin warned about six CVEs (<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-9017\" target=\"_blank\" rel=\"noopener\">CVE-2019-9017<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-3980\" target=\"_blank\" rel=\"noopener\">CVE-2019-3980<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-3957\" target=\"_blank\" rel=\"noopener\">CVE-2019-3957<\/a>, <a href=\"https:\/\/www.cvedetails.com\/cve\/CVE-2015-8220\/\" target=\"_blank\" rel=\"noopener\">CVE-2015-8220<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2013-3249\" target=\"_blank\" rel=\"noopener\">CVE-2013-3249<\/a>, and <a href=\"https:\/\/www.cvedetails.com\/cve\/CVE-2018-12897\/\" target=\"_blank\" rel=\"noopener\">CVE-2018-12897<\/a>) when we researched potentially vulnerable products that could be breached during the COVID-19 lockdown.<\/p><p dir=\"ltr\" style=\"text-align: left;\">This is a massive attack launched simultaneously at sensitive government agencies with the intent to cripple the country. The attackers have surreptitiously monitored the email communication of several federal agencies and have launched this attack. Here are a few recommendations to keep your organization safe:<\/p><ul dir=\"ltr\"><li style=\"text-align: left;\" role=\"presentation\">Patch all vulnerabilities related to SolarWinds.<\/li><li style=\"text-align: left;\" role=\"presentation\">It is recommended to upgrade to Orion Platform version 2020.2.1 HF 1\u202fas soon as possible.<\/li><li style=\"text-align: left;\" role=\"presentation\">Isolate your network from SolarWinds&#8217; servers and restrict the scope of connectivity until further investigation is done.<\/li><li style=\"text-align: left;\" role=\"presentation\">Consider changing passwords to ensure the security of your environment.<\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-cb7636c elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"cb7636c\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-3523243\" data-id=\"3523243\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5647479 elementor-widget elementor-widget-text-editor\" data-id=\"5647479\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h3 dir=\"ltr\" style=\"text-align: center;\"><a href=\"https:\/\/securin.io\/contact-us\" target=\"_blank\" rel=\"noopener\">Talk with our experts<\/a> to help fortify your defenses and strengthen your cybersecurity posture.<\/h3>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Dec 13 SolarWinds disclosed that vulnerabilities in their network management tool Orion was used to mount attacks on FireEye and on several Government agencies. Securin analyzed Orion\u2019s 15 Vulnerabilities and found a known critical Privilege Execution Exploit that needs immediate remediation along with an upgrade to Orion Platform.<\/p>\n","protected":false},"author":1,"featured_media":20625,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[82,631,81],"tags":[341,338],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7578"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=7578"}],"version-history":[{"count":15,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7578\/revisions"}],"predecessor-version":[{"id":20640,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7578\/revisions\/20640"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/20625"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=7578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=7578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=7578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}