Microsoft researchers have discovered a previously undisclosed vulnerability in the SolarWinds Serv-U software while monitoring threats related to Log4J vulnerabilities. 

Jonathan Bar Or explained on Twitter that while he was hunting for a Log4J exploit attempt, he noticed attacks coming from serv-u.exe. 

more Log4j

• Log4j zero-day: How to protect yourself
• Apache releases new 2.17.0 patch
• Security firm discovers new attack vector
• 10 questions you need to be asking
• Governments release Log4j advisory
• So far, nearly half of corporate networks have been attacked
• US: Hundreds of millions of devices at risk

"Taking a closer looked revealed you could feed Ssrv-U with data and it'll build an LDAP query with your unsanitized input! This could be used for log4j attack attempts, but also for LDAP injection," he wrote. 

"Solarwinds immediately responded, investigated and fixed the#vulnerability. Their response is the quickest I've seen, really amazing work on their part!"

Microsoft later released a blog about the issue, tracked as CVE-2021-35247, and said it is an "input validation vulnerability that could allow attackers to build a query given some input and send that query over the network without sanitation."

In their advisory, SolarWinds said the Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. The attempted attacks against Serv-U were unsuccessful, according to SolarWinds. 

"SolarWinds has updated the input mechanism to perform additional validation and sanitization. No downstream effect has been detected as the LDAP servers ignored improper characters," the company said, adding that it affects 15.2.5 and previous versions. 

NTT Application Security's Ray Kelly toldZDNetthat the vulnerability surprised and concerned him, considering SolarWinds is fresh on the heels of their previous breach that affected multiple customers. 

"Given that the Log4j disclosure was published in December, this Open Source vulnerability should have been of the utmost priority for SolarWinds. While it appears that SolarWinds was not susceptible to have the vulnerable component exploited, it's still not something you want in your software product," Kelly said.

"Most all application security products can detect the Log4j vulnerability giving developers the ability to quickly identify and fix issue." 

Microsoft urged customers to apply the security updates explained in the SolarWinds advisory and said customers can use their tools to identify and remediate devices that have the vulnerability. Microsoft Defender Antivirus and Microsoft Defender for Endpoint also detect behavior related to the activity, they added. 

Netenrich's John Bambenek added that Microsoft's warning and SolarWinds' quick response time represented a positive example of how vulnerabilities need to be dealt with.  

"This is the kind of vulnerability and research cooperation we need, where a major tech company with visibility to see the attacks reaches out to the software company, and a fix is rushed to production," Bambenek said. 

Security

8 habits of highly secure remote workersHow to find and remove spyware from your phoneThe best VPN services: How do the top 5 compare?How to find out if you are involved in a data breach -- and what to do next

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next