Running external scripts and programs in response to alerts is an integral part of designing an extensible system that can respond to outages, network issues, and mission-critical hardware failure. It is a very powerful tool in the hands of monitoring administrators that can help them shorten the time to act on issues in their business infrastructure. As such, the setup and use of these tools is restricted to high-privilege users, who can create alerts:
SolarWinds Platform admin and alert admin users.
While these users are high-privilege in the SolarWinds Platform system, they are limited in what they can do on the SolarWinds Platform machine itself by the Windows accounts available in SolarWinds Platform as well as the default account for alerting actions. If such a SolarWinds Platform user were compromised, allowing it to set up alerts to execute malicious programs and scripts could lead to escalation of privilege for the attacker.
When setting up the alert action that runs the scripts, you need to select the account for running the script. 


To mitigate such risks, SolarWinds Platform 2020.2.1 HF2 introduces measures to specify and restrict the default action account on the SolarWinds Platform machine that can be used to run external programs and scripts. The setting can be changed only by SolarWinds Platform machine administrator-level accounts to prevent SolarWinds Platform users allowing themselves use of the highest-privilege machine accounts.

Even with this restriction in place, SolarWinds strongly recommends that you create tailored low-privilege accounts on the machine to run specific external program and script alert actions and to perform WMI node polling. We have made it easier to specify a user for an external action by listing Windows accounts already in use in SolarWinds Platform.

Windows accounts shared for external actions and WMI node polling
External alert actions use Windows machine and domain accounts. These accounts are added either when specifying a WMI node polling account, or when adding an account for an external program or script action. This means that users can now use these accounts for executing external actions as well as polling WMI nodes. Therefore, adding and using accounts with administrative privileges, such as domain administrators, is not recommended unless strictly necessary due to risk of compromise.

CVEs
SolarWinds would like to thank our Security Researchers for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the following vulnerability: 

• CVE-2020-14005

Recommendations

• Change the default account for running external actions (see below)
• Create tailored low-privilege accounts to poll WMI nodes and use them when running external actions
• Avoid adding accounts with administrator privileges to mitigate the risk of compromising
• Follow these recommendations for storing scripts:
  • Store scripts in SolarWinds Platform alert actions.
  • Avoid storing scripts in network shares.
  • For stored scripts, provide privileges to execute the script to the alert execution account. Require Administrator privileges for write access.
  • Audit the script location.

Change the default user for running external actions

1. Go to the SolarWinds Platform machine and log in as an administrator-level account.
2. Open the registry editor and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SolarWinds\Orion\Core\DefaultAccount.
3. Edit the ActionAccount key value and specify one of the built-in Windows accounts. If left empty, alert actions set to the default account will not execute until an account is explicitly added to them.
4. Verify that actions using the default account continue working correctly or choose an account for each action.
5. The names of built-in accounts vary with the locale of the machine. On English locale machines, these accounts are (in descending order by privilege): NT AUTHORITY\SYSTEM, NT AUTHORITY\NETWORK SERVICE and NT AUTHORITY\LOCAL SERVICE.