Hardcoded Credential Vulnerability Found in SolarWinds Web Help Desk
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-28986 | Java Deserialization RCE in SolarWinds Web Help Desk SolarWinds Web Help Desk is susceptible to a Java deserialization of untrusted data flaw (CWE-502) in which maliciously crafted serialized Java data sent to the application can trigger remote code execution on the host machine. The flaw is rated 9.8 (network vector, no privileges or user interaction required), though SolarWinds has been unable to reproduce exploitation without authentication after thorough testing and recommends patching all deployments out of caution. A successful attacker gains the ability to run arbitrary commands on the Web Help Desk server, typically yielding control of the host and access to help-desk data. All Web Help Desk versions are potentially affected, and SolarWinds has released a hotfix/patch to address the issue. The bug is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-15, ordered federal agencies to patch by a Friday deadline, and EPSS estimates an 84.6% probability of exploitation within 30 days (100th percentile). Do: Upgrade every Web Help Desk deployment to the patched release per SolarWinds' security advisory (a hotfix addressing the issue in all versions is available); if immediate patching is not possible, restrict network access to the Web Help Desk web interface and watch the host for signs of command execution. Federal agencies must meet the CISA KEV remediation deadline, and defenders should also review SolarWinds' related Web Help Desk advisories (including the separately fixed hardcoded-credential issue) while patching. | 9.8 | 85% | KEV |
| moderateplausibly on the order of tens of thousands of on-premises deployments, with internet-exposed instances likely numbering in the low thousands | |
| CVE-2024-28987 | Hardcoded Credential in SolarWinds Web Help Desk Allows Unauthenticated Access SolarWinds Web Help Desk (WHD) contains hard-coded credentials (CWE-798): fixed, built-in authentication material embedded in the shipped software. Because the same credentials exist on every WHD installation, a remote attacker who knows them can authenticate to WHD without any user account, with no privileges or user interaction required (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). Successful use grants access to internal WHD functionality and the ability to modify data, with high confidentiality and integrity impact but no availability impact. Any organization running an unpatched WHD instance is affected, particularly internet-exposed deployments such as those operated by managed service providers and enterprise IT service desks. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-15 (ransomware use not yet reported), EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), and no public proof-of-concept was known at the time of this record. Do: Upgrade all WHD instances to the patched SolarWinds release that includes the October 2024 fix for CVE-2024-28987 (check the SolarWinds PSIRT advisory for the exact fixed version, e.g., WHD 12.8.4 or later); the required KEV action applies, and U.S. federal agencies must remediate by November 5, 2024. Prioritize internet-exposed WHD servers: restrict network access to the help desk interface/API until patched and review logs for unauthenticated access using built-in credentials, since exploitation is confirmed in the wild. If patching is not possible, apply mitigations per vendor instructions or discontinue use of the product, as CISA recommends. | 9.1 | 93% | KEV |
| moderate≈ a few thousand internet-exposed WHD instances, with total deployments likely in the low tens of thousands worldwide (estimate) |
Full article358 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 22, 2024Vulnerability / Network Security
SolarWinds has issued patches to address a new security flaw in its Web Help Desk (WHD) software that could allow remote unauthenticated users to gain unauthorized access to susceptible instances.
"The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing [a] remote unauthenticated user to access internal functionality and modify data," the company said in a new advisory released today.
The issue, tracked as CVE-2024-28987, is rated 9.1 on the CVSS scoring system, indicating critical severity. Horizon3.ai security researcher Zach Hanley has been credited with discovering and reporting the flaw.
Users are recommended to update to version 12.8.3 Hotfix 2, but applying the fix requires Web Help Desk 12.8.3.1813 or 12.8.3 HF1.
The disclosure comes a week after SolarWinds moved to resolve another critical vulnerability in the same software that could be exploited to execute arbitrary code (CVE-2024-28986, CVSS score: 9.8).
The flaw has since come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA), although how it's being abused in real-world attacks remains unknown as yet.
Additional details about CVE-2024-28987 are expected to be released next month, making it crucial that the updates are installed in a timely manner to mitigate potential threats.
Update
Horizon3.ai has shared about CVE-2024-28987, which "allows unauthenticated attackers to remotely read and modify all help desk ticket details – often containing sensitive information like passwords from reset requests and shared service account credentials."
About 827 instances of SolarWinds Web Help Desk are reachable on the internet, with a majority of the instances located in the U.S., France, Canada, China, and India.
"When assessing the exposure of our own clients, we found that organizations typically revealed sensitive process information for IT procedures such as user onboarding, password resets, and accessing shared resources," Zach Hanley said.
"While this vulnerability does not lead to fully compromising the WHD server itself, we found the risk of lateral movement via credentials was high."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/08/hardcoded-credential-vulnerability.html