Check your environment for the Sunburst vulnerability using the new PowerShell script

In response to the recent security vulnerability, SolarWinds has implemented a new script that helps you determine whether you are currently using a compromised version of SolarWinds Orion Platform products. This script also has an additional option that helps you clean up your environment by clearing out cached versions of compromised SolarWinds.Orion.Core.BusinessLayer.dll and installers that could potentially install this compromised version again.

This article is valid for Orion Platform 2019.4 and Orion Platform 2020.2. For the latest details, including the list of affected Orion Platform versions, please see the Security Advisory.

Execute the PowerShell script on your Orion Platform server, any additional polling engines, HA servers, and websites that you want to check for the SolarWinds.Orion.Core.BusinessLayer.dll file that contains the malicious code.

1. Download the PowerShell script here.
   The scripts are not supported under any SolarWinds support program or service. The scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.

2. Extract the script from the zipped archive, and copy the script to the Orion Platform server.

3. As an administrator, execute the script in PowerShell.
   Script file hashes:

   Algorithm	Hash
   SHA1	4D1ADB22E537FD1AF0597A0A8FF44B2F911AAFC3
   SHA256	87E1831C0B9DA8D905B517EC62011B404FA2E22AB565C0225A29C2FA7AB8AF39
   MD5	E1072103442F61B37EA1A758147D66A0

If you are running an affected version of SolarWinds Orion Platform products, you will see script output like the following:

As shown in the example above, there are two recommended actions:

• Cleanup – This will remove affected installers and/or cached libraries.

• Upgrade – The recommended version in this case is 2021.2.1 HF2, but SolarWinds strongly recommends upgrading to the latest available version, as there is a chance that a newer version was released and was not available at the time this script was created.

If you launch this script again with the recommended options, the ‘-Cleanup -Confirm’ process will again list affected components and prompt for confirmation before deletion of each affected file. After removing all files, the only remaining recommended action is to upgrade to the newest version.

After upgrading, you can launch the script one more time to verify that there are no more known problems in your environment. Output should be similar to the following:

If script output is similar to the following (no recommended actions), there are no vulnerabilities present that this script was intended to detect.