CVE-2020-10148
CRITICAL KEV NUCLEISolarWinds Orion Platform 2019.4 HF 5, 2020.2, 2020.2 HF 1 - Unauthenticated API Authentication Bypass
Title source: llmExploitation Summary
CVE-2020-10148 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 3 public exploits from researchers including B1anda0, rdoix, horrister. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Python script that scans for CVE-2020-10148, a remote code execution vulnerability in SolarWinds Orion API. The script checks for the presence of specific strings in the response to determine if the target is vulnerable.
Description
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
Exploits (3)
This repository contains a Python script that scans for CVE-2020-10148, a remote code execution vulnerability in SolarWinds Orion API. The script checks for the presence of specific strings in the response to determine if the target is vulnerable.
This PoC exploits CVE-2020-10148, a local file disclosure vulnerability in SolarWinds Orion, by leveraging a path traversal issue in the .i18n.ashx handler to bypass authentication and retrieve sensitive files like web.config and SWNetPerfMon.db.
This repository contains detection tools for CVE-2020-10148 (SolarWinds SUNBURST), including a DNS encoding demonstrator, DLL hash verifier, and IOC scanners. It does not include functional exploit code but provides utilities to identify compromised systems.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H