SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization

id: CVE-2024-28986

info:
  name: SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
  author: rxerium
  severity: critical
  description: |
    SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce without authentication but still recommended immediate patching. With a CVSS score of 9.8, this vulnerability was discovered by Inmarsat Government researchers and added to CISA's Known Exploited Vulnerabilities Catalog due to active exploitation in the wild. The complete attack vector requires low complexity and has high impact on confidentiality, integrity, and availability. This vulnerability was later bypassed, leading to CVE-2024-28988 and subsequently CVE-2025-26399. Fixed in version 12.8.3 Hotfix 1.
  impact: |
    Attackers can execute arbitrary commands on the host machine, potentially leading to full system compromise.
  remediation: |
    Apply the available patch provided by SolarWinds.
  reference:
    - https://www.helpnetsecurity.com/2024/08/15/cve-2024-28986/
    - https://threatprotect.qualys.com/2024/08/18/solarwinds-web-help-desk-whd-java-deserialization-vulnerability-cve-2024-28986/
    - https://thehackernews.com/2024/08/solarwinds-releases-patch-for-critical.html
  metadata:
    verified: true
    max-request: 1
    vendor: SolarWinds
    product: web_help_desk
    cvss-score: 9.8
    cwe-id: CWE-502
    cisa-kev: true
    shodan-query: http.favicon.hash:"1895809524"
  tags: cve,cve2024,kev,solarwinds,webhelpdesk,deserialization,rce,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/helpdesk/WebObjects/Helpdesk.woa"

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2

    extractors:
      - type: regex
        name: build_token
        part: body
        group: 1
        regex:
          - "\\?v=([0-9]+_[0-9]+_[0-9]+_[0-9]+)"
        internal: true

      - type: dsl
        name: version
        dsl:
          - "replace(build_token, '_', '.')"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Web Help Desk Software"
          - "SolarWinds WorldWide"
          - "/WebObjects/Helpdesk.woa"
          - "HCS Web Help Desk"
        condition: or

      - type: dsl
        dsl:
          - "compare_versions(version, '< 12.8.3.0')"