Network Management

Mitigate RCE via Actions and JSON Deserialization

When you test an alert action, the button click can be used to execute remote code (ZDI-CAN-12213). To address the vulnerability, upgrade to Orion Platform 2020.2.5. To mitigate the vulnerability on Orion Platform 2020.2.4 and earlier, modify the website or IIS configuration and block the Test button using one of the suggested workarounds.

First published date

4/13/2021 7:02 AM

Last published date

4/13/2021 7:02 AM

Overview

The FromJson method is vulnerable to JSON deserialization despite the deny list (ZDI-CAN-12213). To address the vulnerability, upgrade to Orion Platform 2020.2.5. To mitigate the vulnerability on Orion Platform 2020.2.4 and earlier, modify the website or IIS configuration and disable or block the Test Action button.

Product section

Orion Platform

Cause

ZDI-CAN-12213

Resolution

Orion Platform 2020.2.5

SolarWinds recommends that you upgrade to Orion Platform 2020.2.5, which was released on March 25, 2021.

Orion Platform 2020.2.4 and earlier 

To mitigate this issue on 2020.2.4 or earlier, complete the following steps:

 

Option 1 - Use IIS & URL Rewrite

This workaround requires the URL Rewrite IIS plug-in. You can download it from Microsoft's IIS site at URL Rewrite (© 2021 Microsoft, available at https://www.iis.net/downloads/microsoft/url-rewrite, obtained on March 31, 2021). 
  1. Download and deploy the "URL Rewrite" extension.
  2. Open "URL Rewrite" in the IIS Manager.
  3. Click Add rule(s).. and select "Request blocking" type. 
  4. Type the following regex pattern into the Pattern (URL Path) field: 
    */api/Action/TestAction*
  5. Select the appropriate rule action. SolarWinds recommends that you select "Abort Request". Other types may cause additional errors in the Orion Web Console, such as session timeout.
    image
The test action functionality is disabled. When you try to test an alert action, the action is not executed. A pop-up with the message ‘Undefined’ is displayed.

 

Option 2 - Tweak Global.asax

This workaround does not require any extra software.
Because of security reasons, you can only use this workaround on non-pre-compiled Orion websites. See Disable pre-compiled website to allow optimization to run and be skipped for instructions on how to disable the pre-compiled website.
Note: Configuration wizard reverts the edits. If you run the Configuration wizard, you always need to repeat the workaround steps.
  1. Navigate to Orion website folder (default: C:\inetpub\SolarWinds).
  2. Edit the "Global.asax" and find the following (around line 365): 
    protected void Application_BeginRequest
  3. Add the following code snippet right at the beginning of this method. (The error code can be changed. SolarWinds suggests that you use 400 as the status code.)
    if (Request.Url.AbsolutePath.StartsWith("/api/Action/TestAction", StringComparison.InvariantCultureIgnoreCase))
{
Response.Clear();
Response.StatusCode = 400;
Response.End();
}
  4. Save the file.
The test action functionality is disabled. When you try to test an alert action, the action is not executed. A pop-up with the message ‘Undefined’ is displayed.

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.