Vulnerability disclosure
SWQL injection in SolarWinds Platform
SolarWinds Platform (≤ 2024.1 SR 1)
CVE-2024-28996 is a SWQL (SolarWinds Query Language) injection flaw in the SolarWinds Platform that let a crafted query manipulate the underlying database layer. It was found during penetration testing for the NATO Communications and Information Agency and fixed in SolarWinds Platform 2024.2.
OffSeq
3 min read
Severity: HighCVSS 7.5CVE-2024-28996
Key facts
- Identifier
- CVE-2024-28996
- Class
- CWE-89 (SQL/SWQL Injection)
- Severity
- High
- CVSS
- 7.5
- Vendor
- SolarWinds
- Affected
- SolarWinds Platform 2024.1.1 and earlier
- Fixed in
- SolarWinds Platform 2024.2
- Role
- Discovery credited by vendor
- Status
- Published, patched
CVSS base score
/ 10High
Every score is built from eight plain questions about how an attack works and what it costs you.
How hard it is to exploit
What the attacker can do
Select a metric to see what it means
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
§ 01. Overview
SolarWinds Platform (formerly the Orion Platform) is the shared foundation for SolarWinds' network, systems, and application monitoring products. It exposes SWQL, the SolarWinds Query Language, as a read-oriented query interface over the platform's information model. SWQL lets operators and integrations query monitored entities using a SQL-like syntax that the platform translates into queries against its back-end database.
CVE-2024-28996 is a SWQL injection vulnerability in that interface. The flaw was identified during penetration testing performed for the NATO Communications and Information Agency (NCIA), and SolarWinds credited the discovery in its advisory. NVD records the issue as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) with a CVSS v3.1 base score of 7.5 (High).
§ 02. How it works
SWQL injection is the SolarWinds-specific form of SQL injection. Because SWQL statements are ultimately compiled down to queries executed against the platform's underlying database, input that is not properly neutralized before it reaches that translation layer can alter the structure of the resulting query rather than being treated purely as data. An attacker who can influence a SWQL query can therefore manipulate the back-end database queries the platform runs on their behalf.
The public CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the reachable conditions: the vector is Adjacent (AV:A) rather than fully remote, attack complexity is High (AC:H), and no privileges or user interaction are required. SolarWinds' own description notes that attack complexity is high for this vulnerability. The impact metrics are High across confidentiality, integrity, and availability, reflecting that a successful injection can read, alter, or disrupt data handled through the database layer. Beyond these publicly documented properties, the precise injection point and exploitation mechanics are not detailed in the public record and are not reproduced here.
§ 03. Impact
The SolarWinds Platform sits at the center of many monitoring deployments and holds an inventory of infrastructure, credentials-adjacent metadata, alerts, and operational telemetry. An injection that reaches the back-end query layer undermines the trust boundary between user-supplied query input and the database, which is why the CVSS metrics rate confidentiality, integrity, and availability impact all as High.
The mitigating factors are the Adjacent attack vector and High attack complexity, which raise the bar for practical exploitation compared with a straightforward internet-facing, low-complexity SQL injection. The issue is nonetheless rated High severity, and given the platform's privileged position in a monitored environment, affected organisations were advised to remediate promptly.
§ 04. Affected and fixed versions
The vulnerability affects SolarWinds Platform 2024.1.1 and earlier (the grounding for this disclosure refers to versions up to 2024.1 SR 1). SolarWinds addressed it in SolarWinds Platform 2024.2.
Remediation is an upgrade to 2024.2 or later. CVE-2024-28996 was fixed as part of the same 2024.2 release that resolved several other SolarWinds Platform issues, so applying that release addresses this SWQL injection along with the other vulnerabilities documented in the release notes.
§ 05. Disclosure and outcome
The vulnerability was discovered during authorised penetration testing conducted for the NATO Communications and Information Agency and reported to SolarWinds. SolarWinds published a security advisory, coordinated a fix, and credited the discovery. The CVE was assigned CVE-2024-28996 and published via NVD.
The discovery is credited to Nils Putniņš (OffSeq Cybersecurity).
§ 06. Disclosure timeline
- 2024-03-13CVE-2024-28996 reserved
- 2024-06-04Vulnerability published; SolarWinds Platform 2024.2 released with the fix
References
- NVD – CVE-2024-28996 (opens in a new tab) (https://nvd.nist.gov/vuln/detail/CVE-2024-28996)
- SolarWinds Trust Center – Security Advisory CVE-2024-28996 (opens in a new tab) (https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28996)
- SolarWinds Platform 2024.2 Release Notes (opens in a new tab) (https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm)
- CERT-EU Security Advisory 2024-055 (opens in a new tab) (https://cert.europa.eu/publications/security-advisories/2024-055/)
Credit
Discovered by Nils Putniņš (OffSeq Cybersecurity) during penetration testing for the NATO Communications and Information Agency; fixed in SolarWinds Platform 2024.2.
More results
Cross-site scripting vulnerability in Oracle Enterprise Command Center
CVE-2023-22107 is a cross-site scripting flaw in the Oracle Enterprise Command Center (ECC) Framework component of Oracle E-Business Suite. An unauthenticated, network-based attacker who tricks a legitimate user into interacting with a crafted request can execute script in that user's session, gaining unauthorised read and update access to a subset of ECC data and connected products. Oracle fixed it in the October 2023 Critical Patch Update.
Vulnerability disclosure20233 min read
Command injection fixed in Estonia’s national eID software
OffSeq found and fixed an OS command injection flaw in DigiDoc4, Estonia's official national eID desktop application. The Linux file-manager integration built shell commands from unsanitised filenames, so a specially crafted filename could execute arbitrary code the moment a user chose to sign or encrypt that file. The fix, which replaced the shell invocation with a safe argument list, was accepted upstream.
Vulnerability disclosure20264 min read
Server crash in CERT.LV’s Graphoscope when a user disconnects during an upload
OffSeq found a denial-of-service flaw in Graphoscope, the open-source platform CERT.LV publishes for querying many independent data sources from one interface and showing their relations as a graph. A user who uploaded an indicator list and closed the connection before processing finished made the server dereference a nil WebSocket and crash, signing out every user. Any self-registered account could trigger it reliably. OffSeq reported the issue to CERT.LV and contributed the fix, which CERT.LV merged.
Vulnerability disclosure20263 min read