CVE-2021-35211
CRITICAL KEV RANSOMWARE NUCLEISolarWinds Serv-U <15.2.3 HF2 - RCE
Title source: llmExploitation Summary
CVE-2021-35211 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 4 public exploits from researchers including NattiSamson, 0xhaggis. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits a heap-based buffer overflow in SolarWinds Serv-U SSH server (CVE-2021-35211) by spraying crafted SSH packets to corrupt memory and trigger arbitrary code execution. The exploit leverages ROP techniques and targets the SSH key exchange process.
Description
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
Exploits (4)
This PoC exploits a heap-based buffer overflow in SolarWinds Serv-U SSH server (CVE-2021-35211) by spraying crafted SSH packets to corrupt memory and trigger arbitrary code execution. The exploit leverages ROP techniques and targets the SSH key exchange process.
This repository contains a detailed technical walkthrough of developing a ROP-based exploit for CVE-2021-35211, a vulnerability in Serv-U FTP v15.2.3.717. It includes an analysis of the vulnerability, exploit development steps, and a Python-based PoC.
This repository contains a functional exploit for CVE-2021-35211, a memory corruption vulnerability in Serv-U FTP for Windows, allowing remote code execution. The exploit includes ROP chains and multiple execution modes (command execution, shellcode stager, download/exec).
This repository contains a functional exploit for CVE-2021-35211, a memory corruption vulnerability in Serv-U FTP for Windows, allowing remote code execution. The exploit includes ROP chains and multiple execution modes (command execution, shellcode stager, download/exec).
Nuclei Templates (1)
SSH-2.0-Serv-U
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H