Network Management

How to secure SQL variables used in Orion Platform

In the SolarWinds® Orion® Platform 2020.2.1 Hotfix 2, a new setting to improve the security of SQL macros was introduced. On fresh installs, this setting is enabled by default. On upgrades, you need to enable it manually. SolarWinds worked with our security, product, and engineering teams to fix the vulnerability CVE-2020-27869.

First published date

12/16/2020 1:29 AM

Last published date

1/21/2021 4:34 PM

Overview

Starting with the Orion Platform 2020.2.1 Hotfix 2, you can use the MacroParser-isSecuringSQLMacroEnabled setting to improve the overall security of your Orion Platform by restricting specific SQL macros. On fresh installs, this setting is enabled by default. On upgrades, you need to enable it manually.

Note: Using this setting requires Administrator privileges.

SolarWinds would like to thank our Security Researchers for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability:
  • CVE-2020-27869

Product section

Orion Platform

Resolution

Components of the Select statement

A query in the SQL macro variable SELECT statement has the following components:
  • A regular SELECT query including the regular select list components.
  • A regular FROM clause including one or more table or view names.
  • A regular WHERE clause.
  • An optional GROUP BY clause.
  • An optional HAVING clause.

Clauses disabled for SQL in the Orion Platform by MacroParser-isSecuringSQLMacroEnabled

When you enable the MacroParser-isSecuringSQLMacroEnabled setting, the following clauses cannot be used in the SQL macro variable:
  • ORDER BY (except when a TOP clause is specified)
  • INTO
  • OPTION clause with query hints
  • FOR BROWSE
 It cannot include a COMPUTE or FOR BROWSE clause, and may only include an ORDER BY clause when a TOP clause is also specified.

How to enable / disable MacroParser-isSecuringSQLMacroEnabled

  1. Open your database in the Orion Database Manager. Use Database Manager to view the SolarWinds database.
  2. Find the MacroParser-isSecuringSQLMacroEnabled setting in the Settings table:
  3. To enable the security macro, set CurrentValue to 1.
  4. To disable the security macro, set CurrentValue to 0.
  5. Restart Alerting Engine v2 and Module Engine. See Start and stop Orion services.

How to debug and troubleshoot MacroParser-isSecuringSQLMacroEnabled

The logs are located in the MacroParser.log, together with other macro variables logs.
You can regulate the logging level using the MacroParsing section in the Log Adjuster tool. See Adjust logging levels with the SolarWinds Log Adjuster.

The relevant lines in the MacroParser log look as follows:
2020-11-09 15:48:25,395 [23] DEBUG SolarWinds.Orion.Core.Common.MacroParsing.MacroParser - (null) Getting SecureSQLMacroEnabled setting from DB...
2020-11-09 15:48:25,395 [23] DEBUG SolarWinds.Orion.Core.Common.MacroParsing.MacroParser - (null) Secure SQL macro turned : ON ...
2020-11-09 15:50:31,321 [12] DEBUG SolarWinds.Orion.Core.Common.MacroParsing.MacroParser - (null) Parsing common macros SQL: SELECT top 1 Caption From Nodes...
2020-11-09 15:50:31,321 [12] DEBUG SolarWinds