Network Management

How to mitigate Job Scheduler RCE (ZDI-CAN-12007)

This article provides the steps to mitigate the Job Scheduler RCE (ZDI-CAN-12007)

First published date

4/1/2021 6:23 PM

Last published date

4/1/2021 6:23 PM

Overview

To address the Job Scheduler RCE, upgrade to Orion Platform 2020.2.5, or complete the steps for mitigating the vulnerability for earlier versions.

Product section

Orion Platform

Cause

Job Scheduler RCE (ZDI-CAN-12007)

Resolution

Orion Platform 2020.2.5

SolarWinds recommends that you upgrade to Orion Platform 2020.2.5, released on March 25, 2021.

Orion Platform 2020.2.4 or earlier

To mitigate the Job Scheduler RCE on 2020.2.4 or earlier, complete the following workaround:

  1. Make a backup of the SWJobEngineSvc2.exe.config file.
    By default, it is located at C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineSvc2.exe.config

  2. Open the SWJobEngineSvc2.exe.config and delete the following line:

     <endpoint address="net.tcp://localhost:17777/solarwinds/jobengine/router" binding="netTcpBinding" bindingConfiguration="WindowsClientOverTcp" contract="SolarWinds.JobEngine.IJobSchedulerWithAsyncOperations" />

  3. Delete the following section:

    <binding name="WindowsClientOverTcp" maxReceivedMessageSize="2147483647" maxBufferSize="2147483647" portSharingEnabled="true" transferMode="StreamedResponse" sendTimeout="00:10:00">          <readerQuotas maxArrayLength="2147483647" maxStringContentLength="2147483647" />          <security mode="Transport">            <transport clientCredentialType="Windows" />          </security>        </binding>

  4. Restart the JobEngine service. See Start, Stop, or Restart Orion Services with the Orion Service Manager.

In case of issues, revert to the backup of SWJobEngineSvc2.exe.config and restart the JobEngine service.