Serv-U CVE-2024-28995: Exploited Path Traversal File Read

What to do

1. Check the Serv-U build on every server; anything below 15.4.2.157 is vulnerable.
2. Upgrade to a current supported Serv-U release, not just 15.4.2 HF2, which reached end of life on July 15, 2026.
3. Restrict the Serv-U web interface to the networks that need it, or put it behind a VPN or reverse proxy.
4. If the server was exposed while unpatched, reset Serv-U user passwords and rotate keys, certificates and service credentials stored on the host.
5. Block requests whose InternalDir or InternalFile parameters contain ../ or ..\ at your WAF or reverse proxy.

How to check if you are affected or compromised

• Search Serv-U, reverse proxy and WAF logs for GET / requests carrying InternalDir and InternalFile parameters, especially with ../, \.., %5C or %2E sequences.
• Look for requests that targeted /etc/passwd, windows/win.ini, Serv-U-StartupLog.txt, Serv-U.Archive or Users.ini, the files GreyNoise saw attackers request.
• Review Serv-U user logins after June 2024 for accounts used from unfamiliar IPs, which could indicate reuse of stolen credentials.

What happened#

On June 5, 2024, SolarWinds published CVE-2024-28995, a directory traversal flaw in Serv-U, its managed and FTP file transfer server. An unauthenticated attacker can read files on the host. Hussein Daher reported it. The fix is Serv-U 15.4.2 Hotfix 2, released the same day for Windows and Linux. SolarWinds' CNA score is CVSS 3.1 8.6 (scope changed, high confidentiality impact, no integrity or availability impact).

On June 11, Rapid7 reproduced the bug and called it trivially exploitable. An external attacker can read "any file on disk, including binary files" if they know the path and the file is not locked. Proof-of-concept code followed within days. GreyNoise explained the root cause. A GET / request carries InternalDir and InternalFile parameters. Serv-U checks the directory for ../ only in the slash style of its own platform, then normalizes slashes, so the opposite style slips through. CISA added the CVE to the KEV catalog on July 17, 2024.

Who is affected#

Serv-U MFT Server and Serv-U FTP Server 15.4.2 HF1 and all earlier versions are affected, on both Windows and Linux. The fixed build is 15.4.2 HF2, which The Hacker News identifies as 15.4.2.157. Later 15.5.x and 2026.x releases include the fix. SolarWinds' lifecycle table shows that 15.4.2 reached end of life on July 15, 2026, and the 15.5 base release on October 8, 2026. A server still on HF2 is therefore patched against this bug but no longer supported.

Do you really need to act?#

Only if you run Serv-U. If you do, check it rather than treat it as an emergency. The bug has been patched for more than two years. Exploitation, however, was real and quick. GreyNoise's honeypots logged attempts within days of the PoC, many of them copy-pasted and broken. One operator spent about four hours working an exploit by hand. The most requested files were /etc/passwd, Serv-U-StartupLog.txt and windows/win.ini. Attackers also tried Serv-U's Serv-U.Archive and Users.ini. Tenable noted that exposed user data may include encrypted passwords.

The bug only reads files; it does not run code. The risk is what those files unlock: credentials, keys and configuration that support a later login. If an unpatched Serv-U faced the internet in mid-2024, assume its readable files were taken.

What to do now#

1. Check the build on each Windows server: (Get-Item "C:\Program Files\RhinoSoft\Serv-U\Serv-U.exe").VersionInfo.FileVersion. Anything below 15.4.2.157 is vulnerable. On Linux, the default install path is /usr/local/Serv-U.
2. Upgrade to a current supported Serv-U release, not just 15.4.2 HF2, which is now past end of life.
3. Limit who can reach the Serv-U web interface. Use a VPN, an allow-list or a reverse proxy.
4. If the server was exposed while unpatched, reset Serv-U user passwords. Rotate SSH host keys, TLS certificates and any service credentials stored on the host.
5. Add a WAF or proxy rule that rejects InternalDir or InternalFile values containing ../, ..\ or their encoded forms.

How to tell if you were hit#

Search Serv-U logs and any proxy, load balancer or WAF logs in front of it for requests that carry InternalDir=. For example: grep -Ei 'InternalDir=.*(\.\.|%2e%2e|%5c)' access.log. GreyNoise's examples look like /?InternalDir=/../../../../windows&InternalFile=win.ini and /?InternalDir=\..\..\..\..\etc&InternalFile=passwd. A 200 response for a request that names Serv-U configuration or user files means data probably left. Then review Serv-U logins since June 2024 for familiar accounts used from unfamiliar addresses.

Timeline#

• Jun 5, 2024 — SolarWinds publishes the advisory and Serv-U 15.4.2 HF2.
• Jun 11, 2024 — Rapid7 reproduces the flaw and calls it trivially exploitable.
• Jun 14, 2024 — GreyNoise deploys honeypots after PoC code appears and soon records exploitation.
• Jun 18, 2024 — GreyNoise reports in-the-wild exploitation attempts.
• Jul 17, 2024 — CISA adds CVE-2024-28995 to KEV, with a federal due date of August 7.
• Jul 15, 2026 — Serv-U 15.4.2 reaches end of life.

Vulnerability records

• CVE-2024-28995 · KEV 2024-07-17 · SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. SolarWinds — CVE-2024-28995 Serv-U Directory Traversal advisory solarwinds.com
2. SolarWinds — Serv-U 15.4.2 Hotfix 2 release notes support.solarwinds.com
3. CVE record — CVE-2024-28995 cve.org
4. NVD — CVE-2024-28995 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-28995 cisa.gov
6. GreyNoise Labs — SolarWinds Serv-U (CVE-2024-28995) exploitation labs.greynoise.io
7. Rapid7 — CVE-2024-28995: Trivially exploitable information disclosure in SolarWinds Serv-U rapid7.com
8. SolarWinds — Serv-U 15.5.4 release notes (lifecycle dates) documentation.solarwinds.com
9. Tenable — CVE-2024-28995 exploited in the wild tenable.com

Coverage and analysis

1. The Hacker News — SolarWinds Serv-U vulnerability under active attack thehackernews.com