CVE-2024-0692

HIGHNuclei

SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-0692 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 25, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 25, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Security Event Manager

Browse SolarWinds / Security Event Manager

Default status: unaffected, unknown

CVE List, VulnCheck2023.4 and previous versionsaffected
Before 2023.4affected

Proofs of concept

1

Repository PoCs

GitHubmachevalia/CVE-2024-0692-SolarWinds-SEM-RCERepository PoCby machevalia0Exploit2 files

19.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2024-0692 that targets SolarWinds Security Event Manager via AMF deserialization. It generates a malicious Java class for a reverse shell, hosts it on an HTTP server, constructs a C3P0 WrapperConnectionPoolDataSource AMF payload, sends it to the target, and provides an interactive shell handler.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single Python script (CVE-2024-0692.py) and a README. The script implements a publicly documented exploit for CVE-2024-0692, a SolarWinds SEM AMF deserialization RCE. It generates a reverse shell payload, hosts it via HTTP, sends the AMF exploit, and provides an interactive shell handler. All behavior is consistent with the stated exploit purpose. No concealed backdoor, unrelated remote access, persistence, credential theft, or deceptive payload targeting the person running the PoC was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonJava
Target softwareSolarWinds Security Event Manager
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete, self-contained exploit script that generates and delivers a deserialization payload to achieve remote code execution and provides an interactive reverse shell handler. It does not merely detect or report a vulnerability; it actively exploits it.

CVE-2024-0692.py:1-550

Requirements

  • Java 8+ JDK (javac) to compile the malicious payload classCVE-2024-0692.py:15
  • Python 3.6+ with requests libraryCVE-2024-0692.py:16-17
  • Network connectivity from attacker to target and from target back to attacker's HTTP server and reverse shell listenerCVE-2024-0692.py:12

Observed behavior

  • Compiles a Java class containing a reverse shell payload (bash and PowerShell variants)CVE-2024-0692.py:171-228
  • Starts an HTTP server to serve the compiled malicious class to the targetCVE-2024-0692.py:340-351
  • Generates an AMF3 deserialization payload using the C3P0 WrapperConnectionPoolDataSource gadget chainCVE-2024-0692.py:231-252
  • Sends the AMF payload via HTTP POST to the target's /services/messagebroker/streamingamf endpointCVE-2024-0692.py:354-390
  • Listens for and provides an interactive reverse shell sessionCVE-2024-0692.py:58-168
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Listener
Payload withheldThis is the intended exploit behavior: receiving a reverse shell from the target after successful exploitation.CVE-2024-0692.py:58-168
Java Payload Generation
Payload withheldStandard reverse shell payload for RCE exploitation; no hidden or unrelated commands.CVE-2024-0692.py:171-228
Http Server
Payload withheldRequired for the C3P0 deserialization gadget to load the malicious class; serves only the expected class file.CVE-2024-0692.py:315-351
Amf Payload Construction
Payload withheldImplements the documented CVE-2024-0692 exploit technique; no extraneous payload data.CVE-2024-0692.py:231-293
Author Contact
Payload withheldAuthor identification in comments and banner; not a backdoor indicator.CVE-2024-0692.py:9CVE-2024-0692.py:416
Review boundaries

What the analysis did not establish

  • The evidence is limited to the source code of the exploit script and a README; no execution or runtime behavior was observed.
  • The C3P0 payload generation function (build_c3p0_hex_payload) appears incomplete or simplified, as it uses a hardcoded JNDI Reference hex template that does not incorporate the provided codebase_url and classname, which may affect reliability.
  • The exploit requires the target to be able to reach the attacker's HTTP server to load the malicious class, which may not be possible in all network configurations.
  • Only the two text files (CVE-2024-0692.py and README.md) were reviewed; no binary files were present in the evidence.
  • The review does not assess whether the exploit works as claimed or is safe to execute against authorized targets.
  • The Java payload is generated at runtime and compiled locally; its content is determined by user-supplied arguments and is not reviewed as a static artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryHIGHSolarWinds Security Event Manager - Unauthenticated RCECVSS 8.8

The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.

Impact

Unauthenticated attackers on the adjacent network can execute arbitrary code remotely on the SolarWinds Security Event Manager, leading to complete system compromise and potential access to all security event data.

Remediation

Upgrade to SolarWinds Security Event Manager version 2023.4.1 or later.

WeaknessesCWE-502
AuthorsDhiyaneshDK
Template tagscvecve2024solarwindsevent-managercisavkevvuln
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:solarwinds:security_event_manager:*:*:*:*:*:*:*:*
FOFA: title="SolarWinds Security Event Manager"
https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2023-4-1_release_notes.htm

Source: ProjectDiscovery

References

3