Network Management

Mitigate the Resource.aspx Reflected Cross-Site Scripting Vulnerability (CVE-2021-35222)

The Resource.aspx Reflected Cross-Site Scripting Vulnerability allows attackers to impersonate users and perform arbitrary actions on their behalf. To resolve this issue, upgrade to Orion Platform 2020.2.6 Hotfix 1. To mitigate this issue on Orion Platform 2020.2.6 and earlier, follow the steps in the resolution section below.

First published date

8/23/2021 5:18 PM

Last published date

2/18/2025 9:16 AM

Overview

The Resource.aspx Reflected Cross-Site Scripting Vulnerability allows attackers to impersonate users and perform arbitrary actions on their behalf. To resolve this issue, SolarWinds recommends you upgrade to Orion Platform 2020.2.6 Hotfix 1.

Product section

Orion Platform

Cause

CVE-2021-35222

Resolution

Orion Platform 2020.2.6 Hotfix 1

SolarWinds recommends that you upgrade to Orion Platform 2020.2.6 Hotfix 1, which is released on August 24, 2021.

Orion Platform 2020.2.6 and earlier 

To mitigate this issue on 2020.2.6 or earlier, execute the following steps on each main polling engine (MP), main polling engine backup, and additional web server (AW).
  1. Download and install URL Rewrite IIS extension from https://www.iis.net/downloads/microsoft/url-rewrite (© 2021 Microsoft, available at https://www.iis.net/downloads/microsoft/url-rewrite, obtained on August 18, 2021). 
  2. Locate the root directory of the Orion website:
    1. Go to "C:\inetpub\SolarWinds" or,
    2. Open IIS Manager, click on the "SolarWinds NetPerfMon" site in the left connections menu. Click on "Explore" in the actions menu on the right.
  3. Open the "web.config" file for edit.
  4. FIND the following line: 
    <defaultDocument enabled="true">
     
  5. PASTE the following code BEFORE the above-mentioned line. 
    <rewrite>
  <rules>
    <rule name="BlockInvalidResourceTitle" patternSyntax="ECMAScript" stopProcessing="true">
        <match url="resource\.aspx" />
    <conditions>
            <add input="{QUERY_STRING}" pattern="title=.*[%<>()"';&+]+" />
        </conditions>
        <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
    </rule>
  </rules>
</rewrite>
  6. Save the file.
If an attacker tries to misuse the vulnerability, the attempt is blocked and you receive HTTP error 403 instead.

To verify the workaround:
  1. Navigate in browser to "<YOUR_ORION_SERVER_NAME>/Orion/Resource.aspx?Resource=ResourceNotFound.ascx&Title=%3C".
  2. You should receive HTTP ERROR 403.