SolarWinds Serv-U CVE-2021-35211 (SSH remote code execution, exploited as a zero-day, CISA KEV): which versions are fixed and how do I check for compromise?

What it is: CVE-2021-35211 is a memory-handling flaw in the SSH service of SolarWinds Serv-U (Managed File Transfer and Secure FTP) that can give an attacker remote code execution on the host. Microsoft reported it as exploited in the wild as a zero-day, SolarWinds patched it in July 2021, and CISA added it to the KEV catalog on November 3, 2021. NVD scores it 10.0. Am I affected: - Serv-U 15.2.3 HF1 and all earlier versions, per SolarWinds. The advisory FAQ limits the exploitable case to the Windows builds of Serv-U MFT and Serv-U Secure FTP. - SolarWinds states the issue requires SSH to be enabled in Serv-U; if SSH is disabled the vulnerability does not apply. Check whether SSH is enabled on each Serv-U host. Fix: 1. Install Serv-U 15.2.3 HF2 or later from the SolarWinds Customer Portal. Upgrade path per SolarWinds: from 15.2.3 HF1 apply HF2; from 15.2.3 apply HF1 then HF2; from earlier versions go to 15.2.3, then HF1, then HF2. Move on to a current release afterward. 2. If you cannot patch right away, disable SSH in Serv-U (SolarWinds says no other interim mitigation is documented) and limit exposure of the file-transfer ports to what is necessary. 3. Hunt for compromise using the vendor's published guidance: review Serv-U's DebugSocketlog.txt for access-violation exceptions in the SSH socket handler (not conclusive alone), review SSH sessions and EDR telemetry for Serv-U launching command interpreters or scripting hosts, and look for unrecognized Global Users in the Serv-U console. Use the current indicator list in the SolarWinds advisory. If you find anything, isolate and rebuild the host, restore data from a known-good backup, rotate credentials and keys that Serv-U or its service account could reach, and contact SolarWinds Support. Verify: the Serv-U version is 15.2.3 HF2 or later (or SSH is disabled), and no unexplained accounts, child processes or temp files are found. Sources: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211 https://nvd.nist.gov/vuln/detail/CVE-2021-35211 https://www.cisa.gov/known-exploited-vulnerabilities-catalog