SWQL injection in SolarWinds Platform
SolarWinds Platform (≤ 2024.1 SR 1)
CVE-2024-28996 is a SWQL (SolarWinds Query Language) injection flaw in the SolarWinds Platform that let a crafted query manipulate the underlying database layer. It was found during penetration testing for the NATO Communications and Information Agency and fixed in SolarWinds Platform 2024.2.
Severity: High CVSS 7.5 CVE-2024-28996 3 min read
Every score is built from eight plain questions about how an attack works and what it costs you.
How hard it is to exploit
What the attacker can do
Select a metric to see what it means
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
§ 01. Overview
SolarWinds Platform (formerly the Orion Platform) is the shared foundation for SolarWinds' network, systems, and application monitoring products. It exposes SWQL, the SolarWinds Query Language, as a read-oriented query interface over the platform's information model. SWQL lets operators and integrations query monitored entities using a SQL-like syntax that the platform translates into queries against its back-end database.
CVE-2024-28996 is a SWQL injection vulnerability in that interface. The flaw was identified during penetration testing performed for the NATO Communications and Information Agency (NCIA), and SolarWinds credited the discovery in its advisory. NVD records the issue as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) with a CVSS v3.1 base score of 7.5 (High).
§ 02. How it works
SWQL injection is the SolarWinds-specific form of SQL injection. Because SWQL statements are ultimately compiled down to queries executed against the platform's underlying database, input that is not properly neutralized before it reaches that translation layer can alter the structure of the resulting query rather than being treated purely as data. An attacker who can influence a SWQL query can therefore manipulate the back-end database queries the platform runs on their behalf.
The public CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the reachable conditions: the vector is Adjacent (AV:A) rather than fully remote, attack complexity is High (AC:H), and no privileges or user interaction are required. SolarWinds' own description notes that attack complexity is high for this vulnerability. The impact metrics are High across confidentiality, integrity, and availability, reflecting that a successful injection can read, alter, or disrupt data handled through the database layer. Beyond these publicly documented properties, the precise injection point and exploitation mechanics are not detailed in the public record and are not reproduced here.
§ 03. Impact
The SolarWinds Platform sits at the center of many monitoring deployments and holds an inventory of infrastructure, credentials-adjacent metadata, alerts, and operational telemetry. An injection that reaches the back-end query layer undermines the trust boundary between user-supplied query input and the database, which is why the CVSS metrics rate confidentiality, integrity, and availability impact all as High.
The mitigating factors are the Adjacent attack vector and High attack complexity, which raise the bar for practical exploitation compared with a straightforward internet-facing, low-complexity SQL injection. The issue is nonetheless rated High severity, and given the platform's privileged position in a monitored environment, affected organizations were advised to remediate promptly.
§ 04. Affected and fixed versions
The vulnerability affects SolarWinds Platform 2024.1.1 and earlier (the grounding for this disclosure refers to versions up to 2024.1 SR 1). SolarWinds addressed it in SolarWinds Platform 2024.2.
Remediation is an upgrade to 2024.2 or later. CVE-2024-28996 was fixed as part of the same 2024.2 release that resolved several other SolarWinds Platform issues, so applying that release addresses this SWQL injection along with the other vulnerabilities documented in the release notes.
§ 05. Disclosure and outcome
The vulnerability was discovered during authorized penetration testing conducted for the NATO Communications and Information Agency and reported to SolarWinds. SolarWinds published a security advisory, coordinated a fix, and credited the discovery. The CVE was assigned CVE-2024-28996 and published via NVD.
The discovery is credited to Nils Putniņš (OffSeq Cybersecurity).
§ 06. Disclosure timeline
- 2024-03-13 CVE-2024-28996 reserved
- 2024-06-04 Vulnerability published; SolarWinds Platform 2024.2 released with the fix