CVE-2024-28987

What it actually does

This vulnerability is a hardcoded credential weakness in SolarWinds Web Help Desk that can allow a remote, unauthenticated attacker to authenticate or reach privileged internal functionality without knowing a legitimate user password. Because the attack is network-accessible, low-complexity, and requires no user interaction, successful exploitation can expose confidential help desk data and allow unauthorized modification of records or configuration. The CVSS vector indicates high confidentiality and integrity impact, with no direct availability impact.

Why it matters to the business

An exposed vulnerable Web Help Desk instance can let an outside attacker access support tickets, user information, operational details, attachments, and internal workflow data, then alter or delete business records. Because this issue is in CISA KEV, has active exploitation reported, has a very high EPSS score, and the KEV remediation deadline of 2024-11-05 has passed, organizations should treat unpatched internet-facing deployments as high-risk even though ransomware use is not currently indicated. The supplied affected-product metadata also references Qualcomm Android components fixed in SoCVersion 2023-03-05; organizations should validate product applicability carefully because the vulnerability description and exploitation context are SolarWinds Web Help Desk-specific.

How an attack unfolds

An attacker first identifies a reachable SolarWinds Web Help Desk deployment, commonly by scanning for exposed WHD web interfaces. The attacker then uses the hardcoded credential condition to access functionality that should require a legitimate authenticated user or administrator. Once access is obtained, the attacker can browse internal help desk content, retrieve sensitive ticket data or attachments, and modify records, settings, or workflow data. Depending on permissions exposed through the vulnerable path, the attacker may attempt to create or modify users, alter ticket history, establish persistence through legitimate-looking accounts, or use information from tickets to support follow-on compromise of other systems.

How to fix it

Apply the SolarWinds vendor update or hotfix that remediates the Web Help Desk hardcoded credential vulnerability, and prioritize all internet-facing WHD systems. If immediate patching is not possible, restrict WHD access to trusted networks or VPN, block direct internet exposure, enforce strong upstream access controls, and monitor for abnormal access until the upgrade is complete. Rotate credentials associated with WHD integrations, service accounts, API access, mail ingestion, directory services, and database connections where compromise cannot be ruled out. Review WHD users, roles, tickets, attachments, configuration, and audit records for unauthorized changes after remediation. The provided package metadata lists fixed versions for Qualcomm Android components as SoCVersion:2023-03-05 for linux_kernel and device/qcom/sepolicy_vndr; verify vendor advisory applicability before using those Android fixed-version references for this SolarWinds WHD issue.

How to confirm the fix worked

Confirm the installed SolarWinds Web Help Desk version and hotfix level against the SolarWinds security advisory for this vulnerability. Validate that externally reachable WHD services are no longer running a vulnerable build and that unauthenticated requests cannot access privileged or internal functionality. Perform authenticated administrative review to confirm no unexpected accounts, role changes, ticket modifications, attachment changes, integration changes, or configuration drift occurred. From the network edge, verify WHD is not directly exposed unless explicitly required and protected by compensating controls. If Android/Qualcomm assets are in scope based on separate vendor mapping, verify the device firmware/security patch level includes SoCVersion 2023-03-05 or later for the listed components.

Typical attack path

1. Identify internet-accessible SolarWinds Web Help Desk instances through scanning, search engines, or prior inventory leaks.
2. Confirm the target is running a vulnerable WHD build or behavior consistent with the hardcoded credential flaw.
3. Authenticate or invoke internal functionality using the hardcoded credential weakness without valid user credentials.
4. Enumerate accessible help desk data, including tickets, users, attachments, configuration, and workflow details.
5. Modify records or configuration to achieve the attacker’s objective, such as data manipulation, concealment, or persistence.
6. Use harvested operational information, credentials, attachments, or internal references for follow-on attacks against other systems.

How to detect it

Review SolarWinds Web Help Desk application logs, web access logs, reverse proxy logs, WAF logs, authentication logs, database audit logs, and operating system process logs for evidence of successful access without a normal authentication flow. Look for requests to WHD administrative, ticket, attachment, user-management, setup, or integration functions from unfamiliar IP addresses, unusual geographies, hosting providers, scanners, or times outside normal administrative activity. Correlate web sessions with expected identity-provider or application login events; sessions or privileged actions without corresponding legitimate authentication are high-signal. Review WHD audit trails for new users, role elevation, password resets, modified tickets, deleted comments, attachment downloads, workflow changes, mail settings changes, LDAP/directory integration changes, database configuration changes, and API/integration changes. Examine database records and application artifacts for mass reads or updates around the same timestamp as suspicious web requests. Because this issue is known exploited, include historical hunting from the publication date and, where feasible, earlier exposure windows. No public ransomware linkage is indicated, but operators may use stolen ticket data for follow-on intrusion or social engineering.

What your security team should do

• Immediately inventory all SolarWinds Web Help Desk deployments, prioritizing internet-facing systems and systems reachable from untrusted networks.
• Patch WHD to the vendor-fixed release or hotfix; treat any unpatched instance as urgent because the vulnerability is in CISA KEV and exploitation is active in the wild.
• If patching is delayed, remove public exposure, restrict access by VPN or allowlist, and increase logging on WHD, reverse proxies, identity providers, and database backends.
• Hunt for unauthorized access, suspicious successful sessions, unexpected administrative activity, ticket tampering, attachment access, and configuration changes since at least the public disclosure date of 2024-08-21.
• Rotate WHD-related service, integration, database, mail, directory, and API credentials if logs are incomplete or exploitation is suspected.
• Review WHD user accounts, administrator roles, ticket history, attachments, and audit logs for persistence or data theft indicators.
• Validate CMDB and vulnerability scanner mappings because the supplied affected-product list includes Android/Qualcomm entries that do not align with the SolarWinds WHD vulnerability description.