QID 730169

SolarWinds Orion is an IT performance monitoring platform. SUPERNOVA is malware that was deployed using a vulnerability in the Orion Platform, and after the Orion Platform had been installed

SUPERNOVA is not malicious code embedded within the builds of Solarwinds Orion Platform as a supply chain attack. It is malware that is separately placed on a server that requires unauthorized access to a customer's network and is designed to appear to be part of a SolarWinds product.

The SUPERNOVA malware consisted of two components. The first was a malicious, unsigned "app_web_logoimagehandler.ashx.b6031896.dll" specifically written to be used on the SolarWinds Orion Platform. The second is the utilization of a vulnerability in the Orion Platform to enable deployment of the malicious code (DLL).

Affected Versions:
Solarwinds Orion Platform software builds for version 2019.4 HF5
Solarwinds Orion Platform software builds for version 2020.2 unpatched
Solarwinds Orion Platform software builds for version 2020.2 HF1
Older versions may also be vulnerable

QID Detection Logic (Unauthenticated):
This QID sends a crafted HTTP GET Request containing a simple C# code to 'Orion/LogoImageHandler.ashx' to see if malicious DLL has been implanted on the target.

An unauthenticated, remote attacker could execute malicious C# code in the memory on the target server.