SolarWinds Serv-U, a widely deployed MFT and file server, has been exploited through two input-handling flaw classes. A memory-corruption vulnerability in its SSH/connection handling gave remote code execution against the exposed service, used in targeted attacks. Separately, a directory-traversal flaw in its web interface allowed an attacker to read arbitrary files from the host filesystem, disclosing configuration, credentials, and other sensitive files. Both are reachable against an exposed Serv-U, making version-matched exploitation straightforward.
# fingerprint Serv-U (web and SSH/FTP services)
curl -skI https://<target>/ # Serv-U web banner
nmap -p22,80,443 -sV <target> | grep -i serv-u
# RCE variant targets the SSH handling; traversal variant reads host files:
curl -sk --path-as-is 'https://<target>/<endpoint>/../../../../windows/win.ini'
# match the Serv-U build to the advisory for the specific flaw and payload.
Exploitation notes#
- Two distinct classes: the SSH-handling memory-corruption RCE (reached on the SSH/connection service) and the web directory-traversal file read; which applies depends on the Serv-U build.
- The traversal reads arbitrary host files at the service's privilege, so target configuration and credential files that unlock the appliance and beyond.
- The RCE variant lands code execution on the host directly; fingerprint the build and match the advisory for the exact flaw.
- The traversal mechanism is the same class as the generic path traversal; the RCE is a product-specific memory-corruption bug.