SolarWinds DPA Security Misconfiguration Advisory: Hardening Guide for HTTP/TLS/SQLi

Vulnerability Overview SolarWinds Database Performance Analyzer (DPA) has several security configuration issues that may lead to the following risks: Unencrypted HTTP Traffic: In DPA 2023.2 and earlier versions, HTTP traffic is enabled by default, which may lead to data leakage. Use of Weak Protocols: Some older versions of DPA still support TLS 1.0 and TLS 1.1, which have known vulnerabilities. Self-Signed Certificates: Self-signed certificates are used by default, which may be exploited in man-in-the-middle (MitM) attacks. Custom SQL Injection: Allows administrators to insert custom SQL statements, posing an SQL injection risk. Improper Tomcat Server Configuration: May lead to slow HTTP denial-of-service (DoS) attacks and Host Header attacks. Affected Scope DPA 2023.2 and earlier versions: HTTP traffic is enabled by default. DPA 2021.1.1 and earlier versions: Support TLS 1.0 and TLS 1.1. All versions: Use self-signed certificates by default. All versions: Allow administrators to insert custom SQL statements. All versions: Improper Tomcat server configuration may lead to slow HTTP denial-of-service (DoS) attacks and Host Header attacks. Remediation 1. Disable the HTTP Connector: - In DPA 2023.2 and earlier versions, disable the HTTP connector and ensure that only HTTPS is used. - Configuration method: Refer to DPA 8123. 2. Disable Weak Protocols: - Disable TLS 1.0 and TLS 1.1, and use only TLS 1.2 or higher. - Configuration method: Edit the file and set . 3. Use CA-Issued Server Certificates: - Generate or use certificates from a Certificate Authority (CA) to replace self-signed certificates. - Configuration method: Refer to DPA SSL/TLS with Custom Certificates. 4. Configure Password Protection: - Configure password protection for the feature that allows custom SQL execution to prevent unauthorized access. - Configuration method: Refer to DPA Custom SQL Password Protection. 5. Encrypt Keystore Passwords in the Tomcat Server Configuration: - Encrypt the keystore password stored in the file. - Configuration method: Refer to DPA Encrypt Keystore Password. 6. Mitigate Risks of Slow HTTP and Host Header Attacks: - Edit the file and configure connection timeouts and the maximum number of connections. - Configuration method: - Restart the DPA service to apply the configuration. POC Code No specific POC code is provided; however, the above configuration steps can be used as remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

SolarWinds DPA Security Misconfiguration Advisory: Hardening Guide for HTTP/TLS/SQLi