Network Management

How to mitigate MSMQ RCE (CVE-2021-25274)

This article provides the steps to mitigate MSMQ Remote Code Execution vulnerability (CVE-2021-25274) in the Orion Platform. Upgrade to Orion Platform 2020.2.4 or later or complete the workaround steps.

First published date

4/1/2021 6:15 PM

Last published date

7/15/2021 7:47 AM

Overview

To work around the MSMQ Remote Code Execution vulnerability in the Orion Platform, upgrade to 2020.2.4 or later, or complete the steps below. 

Product section

Orion Platform

Cause

MSMQ Remote Code Execution (CVE-2021-25274)

Resolution

SolarWinds recommends that you upgrade to Orion Platform 2020.2.4, released in January 2021, or later. See the current version in Orion Platform versions.

Note: In Orion Platform 2020.2.6, MSMQ was removed from the Collector to improve CPU performance and address security concerns.
 

Orion Platform 2020.2.1 and earlier

To mitigate the MSMQ Remote Code Execution on Orion Platform 2020.2.1 and earlier, block the outside MSMQ connections with a firewall.
SolarWinds recommends that you block remote access to MSMQ with a firewall. If PubSub is running over MSMQ instead of RabbitMQ, you might have to exclude other Orion servers from firewall blocking.

On your firewall, block the ports MSMQ is using:
  • TCP: 1801 (MSMQ)
  • TCP: 2103* (MSMQ RPC over TCP)
  • TCP: 2105* (MSMQ RPC over TCP)
  • TCP:2107 (MSMQ management - if you use MSMQ management/auditing tools, these tools might require this port open for remote access)
  • UDP: 3527, 1801
* These port numbers may be incremented by 11 if the initial choice of RPC port is used when Message Queuing initializes. General RPC port 135 is used to discover the 2xxx ports. SolarWinds recommends that you do not disable port 135.

See Network Ports Used by Message Queuing (©2021 Microsoft, available athttps://docs.microsoft.com/en-US/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725576(v=ws.10), obtained on March 11, 2021).

How does the MSMQ RCE fix in Orion Platform 2020.2.4 and later work?

Addressing the MSMQ Remote Code Execution in Orion Platform 2020.2.4 and later is not implemented via ACL restrictions on MSMQ. Instead, the Orion Platform accepts and further processes only legit messages.
For this reason, some tools may not recognize the MSMQ RCE vulnerability as fixed and may report the possibility to push messages to MSMQ. Whereas it might be possible to push data to MSMQ, the fix in the Orion Platform does not allow remote code execution and ensures non-legit data are ignored. Blocking the MSMQ ports is an extra step to ensure the additional hardening of your environment.