According to NetSPI’s team, the vulnerability resides on the com.solarwinds.whd.symmetric.AESGCMSymetricCryptoProvider class, which managed AES-GCM encryption for credentials stored in database backups and configuration files. Patched in version 12.8.5, the flaw stemmed from predictable encryption keys and nonce reuse, enabling practical decryption of stored secrets even without direct system access. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Audit AES-GCM Usage: Ensure nonces are unique per encryption (e.g., using counter-based or random nonces with 96-bit entropy). Kaaviya is a Security Editor and fellow reporter with Cyber Security News. While patching eliminates immediate risks, organizations must adopt defense-in-depth strategies monitoring for credential leaks, segmenting backup storage, and implementing robust key lifecycle management. The SecretKeyServiceImpl class generated keys using init_code values from the database XORed with a static hex value (0xBABEFACE). AES-GCM’s security relies on unique nonces per encryption. She is covering various cyber security incidents happening in the Cyber Space.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 12 Mar 2025 00:30:17 +0000