CVE-2016-4350 in Storage Resource Monitor
Summary
by MITRE
Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the ScriptServlet servlet; the (2) winEventId or (3) winEventLog parameter in the WindowsEventLogsServlet servlet; the (4) processOS parameter in the ProcessesServlet servlet; the (5) group, (6) groupName, or (7) clientName parameter in the BackupExceptionsServlet servlet; the (8) valDB or (9) valFS parameter in the BackupAssociationServlet servlet; the (10) orderBy or (11) orderDir parameter in the HostStorageServlet servlet; the (12) fileName, (13) sortField, or (14) sortDirection parameter in the DuplicateFilesServlet servlet; the (15) orderFld or (16) orderDir parameter in the QuantumMonitorServlet servlet; the (17) exitCode parameter in the NbuErrorMessageServlet servlet; the (18) udfName, (19) displayName, (20) udfDescription, (21) udfDataValue, (22) udfSectionName, or (23) udfId parameter in the UserDefinedFieldConfigServlet servlet; the (24) sortField or (25) sortDirection parameter in the XiotechMonitorServlet servlet; the (26) sortField or (27) sortDirection parameter in the BexDriveUsageSummaryServlet servlet; the (28) state parameter in the ScriptServlet servlet; the (29) assignedNames parameter in the FileActionAssignmentServlet servlet; the (30) winEventSource parameter in the WindowsEventLogsServlet servlet; or the (31) name, (32) ipOne, (33) ipTwo, or (34) ipThree parameter in the XiotechMonitorServlet servlet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/23/2018
The vulnerability identified as CVE-2016-4350 represents a critical multiple SQL injection flaw affecting SolarWinds Storage Resource Monitor (SRM) Profiler version 6.2.2 and earlier. This vulnerability resides within the Web Services web server component that handles various servlet endpoints, creating a substantial attack surface for remote exploitation. The flaw allows attackers to inject malicious SQL commands through multiple input parameters across different servlets, fundamentally compromising the database layer and potentially enabling complete system compromise. The vulnerability is classified under CWE-89 as SQL injection, which represents one of the most prevalent and dangerous web application security flaws according to the CWE database. This type of vulnerability directly aligns with ATT&CK technique T1190, which describes exploiting vulnerabilities in web applications to execute arbitrary code.
The technical implementation of this vulnerability occurs through improper input validation and sanitization within the servlet processing logic. Attackers can manipulate specific parameters in various servlet endpoints to inject malicious SQL payloads that bypass normal input validation checks. The affected parameters span across multiple servlets including ScriptServlet, WindowsEventLogsServlet, ProcessesServlet, BackupExceptionsServlet, and numerous others, indicating a systemic flaw in the application's parameter handling approach. Each vulnerable parameter represents a potential entry point where unvalidated user input directly flows into SQL query construction without proper sanitization or parameterization. The attack vector is entirely remote, requiring no local system access, which significantly increases the exploitability and impact potential. The vulnerability affects the core database communication layer, making it particularly dangerous as successful exploitation could lead to unauthorized data access, data manipulation, or complete database compromise.
The operational impact of this vulnerability extends far beyond simple data theft, as it provides attackers with the capability to execute arbitrary commands on the underlying database server. Successful exploitation could result in complete system compromise, data exfiltration, or the installation of backdoors within the SolarWinds environment. Organizations using affected versions of SRM Profiler face significant risk of unauthorized access to critical storage monitoring data, potentially exposing sensitive infrastructure information. The vulnerability's widespread nature across multiple servlet endpoints means that attackers can potentially exploit various attack paths depending on their specific objectives. From a security operations perspective, this vulnerability represents a critical alert that requires immediate remediation, as it could be leveraged for lateral movement within networks where SolarWinds systems are deployed. The impact is particularly severe in enterprise environments where storage monitoring systems often contain sensitive operational data and serve as critical infrastructure components.
Mitigation strategies for CVE-2016-4350 should focus on immediate patching of affected SolarWinds SRM Profiler installations to version 6.2.3 or later, which contains the necessary security fixes. Organizations should implement network segmentation to limit access to the affected web services, particularly restricting access to the vulnerable servlet endpoints from untrusted networks. Input validation should be strengthened across all servlet parameters through proper parameterization of database queries and implementation of strict input sanitization routines. Security monitoring should be enhanced to detect unusual database access patterns that might indicate SQL injection attempts, with particular attention to the identified vulnerable parameters. Network-based intrusion detection systems should be configured to flag suspicious SQL injection patterns targeting the affected servlet endpoints. Additionally, organizations should conduct comprehensive vulnerability assessments to identify any other potentially affected SolarWinds products or systems within their environment. The remediation process should include thorough testing of the patched versions to ensure that security fixes do not introduce functional regressions in the storage monitoring capabilities. Regular security updates and patch management processes should be reinforced to prevent similar vulnerabilities from emerging in the future, particularly focusing on web application security best practices such as those outlined in OWASP Top Ten and NIST cybersecurity frameworks.