SolarWinds Serv-U L Directory Transversal Vulnerability (CVE-2024-28995)

What is affected, what to do

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

The vulnerability is being actively exploited; treat it as a priority. Update serv-u to version 15.4.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SolarWinds Serv-U eq 15.4.2 HF 1 and previous versions..15.4.2 HF 1 and previous versions

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy SolarWinds Serv-U 15.4.2 HF 2 (or later) — the vendor fix for CVE-2024-28995. Schedule downtime for the FTP/SFTP/HTTP services (TCP 21, 22, 80, 443, management 443/6443) and fully restart the Serv-U process after upgrade.
   • Until patched: remove the Serv-U web interface and FTP services from the public internet or restrict them at the firewall to known administrative source IPs. The traversal via GET /?InternalDir=...&InternalFile=... is trivially reachable over HTTP/HTTPS and is being actively exploited.
   • Review the Serv-U service account on the host and drop it to least privilege (not local admin, not SYSTEM, not Domain Admin). Read access is bounded by this account's permissions — any over-privileged configuration dramatically widens the blast radius.
   • Retrospectively search Serv-U access logs (DebugSocketLog.txt, HTTP logs) for the last 60 days for traversal patterns (../, ..\, %2e%2e, \..\..\). Any hit opens an IR ticket: identify the files readable on the host and treat them as potentially exfiltrated.
   • Rotate credentials, SSH keys, API tokens and certificates that were readable from the Serv-U host — especially /etc/passwd, Serv-U configs containing DB credentials, Windows registry hives, private keys under C:\ProgramData\RhinoSoft\Serv-U\.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place Serv-U in a dedicated DMZ VLAN, egress-whitelist only required backend destinations (AD, SMB shares, logging). No lateral SMB/WinRM path to internal file servers.
   • WAF or reverse proxy in front of Serv-U HTTP: block requests containing InternalDir or InternalFile query parameters, plus patterns ..%2f, ..%5c, %252e%252e. ModSecurity example: SecRule REQUEST_URI "@rx (?i)(\.\.(/|\\|%2f|%5c)){2,}" "id:928100,phase:1,deny,log".
   • Enable IPS/IDS signatures: Emerging Threats ships SIDs for CVE-2024-28995. Load the Suricata/Snort rules on all perimeter sensors and set them to drop, not alert-only.
   • Host hardening: isolate sensitive files (private keys, web.config, SAM, /etc/shadow) from the Serv-U process context — explicitly deny read via NTFS ACL or Linux DAC. On Windows add an AppLocker/WDAC policy constraining the Serv-U process.
   • Configuration review: lock Serv-U "Virtual Paths" and "Home Directories" to absolute boundaries, enforce "Lock users in home directory" globally. Expose the admin UI only through VPN or a Zero-Trust proxy.
   • File-access monitoring: enable Windows Object Access Auditing (Event ID 4663) on critical directories; on Linux use auditd rule -w /etc/shadow -p r -k servu_sensitive.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs (Serv-U HTTP or fronting reverse proxy): matches on GET requests containing InternalDir and .. in parameters. KQL example: W3CIISLog | where csUriQuery has_any ("InternalDir","InternalFile") and csUriQuery matches regex @"\.\.(/|\\|%2f|%5c)".
   • Sigma shape: detection: selection: cs-uri-query|contains: ['InternalDir=', 'InternalFile='] filter: cs-uri-query|re: '\.\.(/|%2f|\\|%5c)' condition: selection and filter, product webserver.
   • Sysmon EID 1 (Process Create) and EID 11 (File Create) on the Serv-U host: unexpected reads by Serv-U.exe / Serv-U-Tray.exe to paths outside its configured home-directory tree.
   • Windows Event ID 4663 against C:\Windows\System32\config\SAM, *.pfx, *.key, web.config with accessing process = Serv-U — unambiguous exploitation signal.
   • Netflow or Zeek: unusual outbound data volume from the Serv-U host immediately after HTTP requests carrying traversal patterns (correlate request-payload size against egress peak within 60 seconds).
   • Retrospective hunt: look for public-exploit user agents (curl/, python-requests/, empty UA) hitting Serv-U URIs over the past 90 days.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Source: cvelistv5, CSA/SingCERT, pwn.watch, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• SolarWinds SolarWinds Serv-U

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

References & sources

• solarwinds.comSolarWinds advisory: CVE-2024-28995Vendor advisory, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28995government-resource, US government resource
• pwn.watchpwn.watch: SolarWinds Serv-U Path Traversalpwn-watch
• NVD (NIST)NVD: CVE-2024-28995pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch