Bishop Fox named “Leader” in 2024 GigaOm Radar for Attack Surface Management. Read the Report ›

SolarWinds Log & Event Manager - Improper Access Control

Gauge reading medium severity


Patch Date

April 10, 2017

Reported Date

February 7, 2017



Systems Affected

SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4


An improper access control vulnerability was discovered in the SolarWinds’ Log & Event Manager (LEM) management console (CMC). The CMC is a restricted environment providing functionality for upgrading or maintaining LEM appliances. This vulnerability allows an authenticated user to bypass restrictions imposed by the CMC and browse the underlying server’s filesystem, as well as read the contents of arbitrary files contained within.

Vendor Status

The vendor has been notified and has issued patches.

Exploit Availability

To demonstrate the impact of this vulnerability, the assessment team browsed the filesystem of the SolarWinds appliance to locate and then read the file containing the admin user’s password hash.

By running the editbanner command in the LEM CLI, a nano session was opened, as shown below:

Figure 1 - nano in restricted mode, as called from SolarWinds LEM CLI


Although not displayed, the key bindings to read a file (^R), or to open the filesystem browser (^R, ^T) were still available, and using them resulted in the following display: 


Figure 2 - Browsing SolarWinds server's filesystem in nano text editor

After navigating to the directory /usr/local/contego/run/manager, the file UserContextLibrary.xml was selected. Its contents, which included the administrative user’s password hash, were dumped into nano’s buffer:



Figure 3 - Administrative user's hash visible from nano editor 

This proof of concept demonstrated that it is possible to escape the access controls implemented by the SolarWinds LEM CLI and the installed nano text editor to browse the underlying filesystem and read arbitrary files. 


Baker Hamilton, MD, MMSc of Bishop Fox

For Reference

The team at Bishop Fox would like to thank SolarWinds for their cooperation in quickly resolving this matter!

Subscribe to Bishop Fox's Security Blog

Be first to learn about latest tools, advisories, and findings.

Default fox headshot blue

About the author, Baker Hamilton


Baker Hamilton, MD, MMSc (OSCE, OSCP) is a Bishop Fox alumnus who focused on application penetration testing, internal and external network penetration testing, source code review, and red teaming.

More by Baker

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.