SolarWinds Web Help Desk Flaws: Technical Analysis, Triage, and Defense
AK
Alex Kim Threat intelligence editor · Updated Aug 22, 2026, 5:37 PM EDT
Analyze critical SolarWinds Web Help Desk vulnerabilities (CVE-2024-28986 & CVE-2024-28987). Learn triage steps, detection rules, and hardening playbooks.
Attackers are actively targeting critical vulnerabilities in SolarWinds Web Help Desk, converting IT service management infrastructure into unauthenticated initial access footholds and reconnaissance hubs. The dual flaws—tracked as CVE-2024-28986 and CVE-2024-28987—grant adversaries the ability to execute remote system commands and extract internal support ticket databases containing administrative credentials, architectural schematics, and cleartext access tokens.
Global internet scanning telemetry reveals over 820 publicly reachable Web Help Desk instances. More than 65 percent of exposed endpoints belong to State, Local, and Education (SLED) organizations, where public-facing ticketing systems frequently operate outside segmented network perimeters.
[[image:poster]]
Attacker
V2
OSExec
"Webshell / Interactive C2 Implant"
"REST API: /OrionTickets/*"
"Full Exfiltration of Historical Tickets & Secrets"
Decoupling RCE and API Exfiltration Mechanics
Initial reporting frequently mischaracterized these flaws as a sequential exploit chain. In production environments, they operate as distinct, standalone vulnerabilities residing in separate architectural layers of the application.
SolarWinds Web Help Desk relies on the legacy Java WebObjects framework. The application exposes an AJAX JSON bridge handler mapped through routes such as /helpdesk/WebObjects/Helpdesk.woa/ajax/.
When incoming requests hit AjaxProxy.handleRequest, the JSON payload passes into org.jabsorb.JSONBridge.call. Deserialization occurs during parameter unmarshalling within BeanSerializer. When resolving generic Object parameters, BeanSerializer dynamically instantiates the class defined in the attacker-controlled javaClass attribute using default constructors and invokes corresponding setter methods.
By supplying the C3P0 library class com.mchange.v2.c3p0.WrapperConnectionPoolDataSource alongside a hex-encoded serialized Java payload in userOverridesAsString, attackers trigger standard readObject execution. This instantiates secondary gadget chains that invoke Runtime.getRuntime().exec(), executing arbitrary system commands under the permissions of the underlying service account.
Identified during security reviews of the initial hotfix, CVE-2024-28987 resides in whd-core.jar within Application.java. Endpoints under /OrionTickets/* handle SolarWinds Orion platform synchronization via OrionTicketController, which extends BasicAuthRouteController.
Static validation strings were embedded directly into controller authentication logic:
Unauthenticated attackers supplying this Base64 header to /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets can paginate and dump every historical ticket, technician note, asset inventory record, and user attribute without executing host commands.
Forensic Artifacts and Host Log Triage
Incident responders must inspect web access logs and endpoint process trees across default installation paths:
Critical Logging Gap: Standard Web Help Desk access logs do not capture HTTP request headers. Because the Authorization header is omitted, malicious requests using hardcoded credentials share identical URI patterns with legitimate Orion platform synchronizations. Forensic teams must correlate source IP addresses against authorized management subnets.
Auditing Ticket Repositories for Exposed Secrets
Because CVE-2024-28987 enables silent data exfiltration, patching the host software does not remediate exposure of stored credentials. Security teams must audit backend databases (PostgreSQL, Microsoft SQL Server, MySQL, Oracle) across primary data tables:
JOB_TICKET: Issue descriptions, subjects, and submitter profiles.
TECH_NOTE: Internal technician troubleshooting notes and temporary credentials.
ASSET and CLIENT: Network hostnames, IP allocations, and directory metadata.
-- Audit ticket records and technician notes for sensitive terms
SELECT
jt.JOB_TICKET_ID,
jt.SUBJECT,
jt.REPORT_DATE,
jt.CLIENT_ID,
tn.NOTE_TEXT
FROM
JOB_TICKET jt
LEFT JOIN
TECH_NOTE tn ON jt.JOB_TICKET_ID = tn.JOB_TICKET_ID
WHERE
jt.SUBJECT ILIKE ANY (ARRAY['%password%', '%vpn%', '%credential%', '%service account%', '%access key%', '%token%', '%login%', '%private key%', '%ssh-rsa%'])
OR jt.QUESTION_TEXT ILIKE ANY (ARRAY['%password%', '%vpn%', '%credential%', '%service account%', '%access key%', '%token%', '%login%', '%private key%', '%ssh-rsa%'])
OR tn.NOTE_TEXT ILIKE ANY (ARRAY['%password%', '%vpn%', '%credential%', '%service account%', '%access key%', '%token%', '%login%', '%private key%', '%ssh-rsa%'])
ORDER BY
jt.REPORT_DATE DESC;
SIEM Detection Engineering and Threat Hunting
Deploy behavioral rules across SIEM, EDR, and endpoint inspection tools to detect active exploitation.
title: SolarWinds WHD Java Process Spawning Command Shell
id: b8d58e39-16a2-4a7b-a19f-0c4a408bfa12
status: stable
description: Detects command shells and discovery tools spawned directly by the Web Help Desk Java engine.
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\WebHelpDesk\bin\jre\bin\java.exe'
- '\WebHelpDesk\bin\jre\bin\javaw.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\certutil.exe'
- '\whoami.exe'
- '\net.exe'
condition: selection_parent and selection_child
level: critical
tags:
- attack.execution
- attack.t1059.001
- attack.t1190
EDR Hunting and YARA Detection
Execute process ancestry hunting in Microsoft Defender for Endpoint using KQL:
DeviceProcessEvents
| where InitiatingProcessFileName =~ "java.exe"
and InitiatingProcessFolderPath has @"WebHelpDesk"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "certutil.exe", "bitsadmin.exe", "net.exe", "sh.exe", "bash.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc
Inspect web directories for deserialization artifacts and webshells using YARA:
rule WebHelpDesk_Exploit_Artifacts {
meta:
description = "Detects Java deserialization artifacts and hardcoded credentials associated with WHD"
strings:
$s1 = "WrapperConnectionPoolDataSource" ascii wide
$s2 = "userOverridesAsString" ascii wide
$s3 = "HexAsciiSerializedMap" ascii wide
$s4 = "helpdeskIntegrationUser" ascii wide
$s5 = "dev-C4F8025E7" ascii wide
$magic_class = { CA FE BA BE }
$magic_ser = { AC ED 00 05 }
condition:
($magic_class at 0 or $magic_ser at 0 or filesize < 10MB) and
(2 of ($s1, $s2, $s3) or all of ($s4, $s5))
}
Network Segmentation and Hardening Playbook
Remediation requires applying sequential vendor hotfixes, removing public internet routing, and enforcing administrative boundaries.
Users / Attackers
WHD
Application Gateway / VPN / MFA
DC
Remediation Workflow
Deploy Software Hotfixes: Upgrade instances to Web Help Desk 12.8.3 Hotfix 1 to mitigate Java deserialization, followed immediately by Hotfix 2 to eliminate hardcoded REST API credentials.
Eliminate Public Exposure: Remove direct WAN access to Web Help Desk servers. Enforce ingress through Zero Trust Network Access (ZTNA) or enterprise VPN solutions requiring multifactor authentication.
De-escalate Service Privileges: Run application services under local accounts or Group Managed Service Accounts (gMSA) with minimal local permissions. Service accounts must never hold Domain Admin privileges.
Restrict Directory Integration: Restrict Active Directory synchronization to read-only queries over LDAPS (port 636).
Rotate Compromised Secrets: Force an immediate enterprise-wide rotation of all API keys, VPN credentials, local administrator passwords, and database connection strings discovered during the ticket database audit.
