SolarWinds Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987)

What is affected, what to do

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

The vulnerability is being actively exploited; treat it as a priority. Update web_help_desk to version 12.8.3. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SolarWinds Web Help Desk eq 12.8.3 Hotfix 1 and previous versions..12.8.3 Hotfix 1 and previous versions

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Cut exposure first: Check whether your Web Help Desk (WHD) instance is reachable from the internet. It typically runs on Tomcat at 8081/HTTP or 8443/HTTPS, though custom installs may differ. Block external access at the perimeter, or restrict it to VPN or known source ranges, until patching is complete.
   • Apply the vendor hotfix: All versions up to and including 12.8.3 Hotfix 1 are affected. Upgrade to 12.8.3 Hotfix 2 or later, and check the SolarWinds advisory for installation prerequisites such as a required prior hotfix level. Confirm the running version in the admin console afterwards.
   • Close the chained risk: Ensure the fix for the WHD Java deserialization flaw CVE-2024-28986 (also on KEV) is in place. Access to internal functionality makes chaining the two flaws attractive to attackers.
   • Preserve evidence before patching: Collect the WHD Tomcat access logs and application logs before updates or restarts rotate them. Then hunt for requests to /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets.
   • Rotate secrets: If the instance was exposed or the logs look suspicious, rotate every secret stored in WHD. That covers the LDAP/AD bind account, SMTP/IMAP mailbox credentials, the database account, integration API keys (e.g. Orion), and any passwords users have pasted into tickets.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place WHD in a dedicated server segment. Allow inbound traffic only from client VLANs or through an authenticating reverse proxy. Restrict outbound traffic to the services WHD actually needs (mail, LDAP, DB) to limit post-compromise pivoting.
   • WAF/reverse-proxy rule: Block external requests to /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets if you don't use the Orion integration. If you do, allow that path only from the Orion server's IP. Additionally, drop Authorization: Basic headers on /ra/ paths from untrusted networks.
   • IPS signature: Write a Suricata rule that alerts on HTTP URI /ra/OrionTickets combined with an Authorization: Basic header. For TLS traffic, enforce it at the proxy or load balancer where traffic is decrypted.
   • Host hardening: Run the WHD service under a non-privileged service account. Use application control or EDR policy to block, or at minimum alert on, child processes of the Java/Tomcat process (cmd.exe, powershell.exe, /bin/sh).
   • Least privilege (IAM): Limit the AD bind account configured in WHD to read-only rights, with no domain admin or write permissions. Periodically scrub tickets for cleartext credentials.
3. 03

   Runbook step 3

   Detection rules

   • Web/Tomcat access logs: Look for requests to /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets from any source other than your Orion server. PUT/POST/DELETE methods (data tampering) and burst volumes are especially suspicious. SPL: index=web uri_path="*/ra/OrionTickets*" NOT src_ip=<orion_ip> | stats count by src_ip, http_method
   • Integration-account usage: Watch application or proxy log entries showing the publicly known username helpdeskIntegrationUser. Treat any use outside the documented Orion integration as compromise.
   • EDR process ancestry (Sysmon EID 1 / Windows 4688): Alert when the WHD Java/Tomcat process spawns cmd.exe, powershell.exe, whoami.exe or certutil.exe. On Linux, watch for sh/bash via auditd execve with the Java process as parent. Sigma shape: ParentImage|endswith: '\java.exe' AND Image|endswith: ['\cmd.exe','\powershell.exe'], scoped to WHD hosts.
   • Data tampering: Use the WHD audit trail and DB logs to spot bulk ticket edits or deletions, new technician or admin accounts, and changed email/LDAP configuration.
   • Network telemetry (Zeek/Suricata): Flag new outbound connections from the WHD server to unfamiliar external IPs, which may indicate exfiltration or C2. Also flag the WHD bind account authenticating from hosts other than WHD (Windows 4624/4625), which suggests stolen credentials are being reused.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• SolarWinds SolarWinds Web Help Desk

Weakness classes (CWE)

• CWE-798Use of Hard-coded Credentials

  Base

  The product contains hard-coded credentials, such as a password or cryptographic key.

  Entry at MITRE CWE-798

References & sources

• solarwinds.comSolarWinds advisory: CVE-2024-28987Vendor advisory, pwn-watch
• support.solarwinds.comSuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2Release notes
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987government-resource, US government resource
• theregister.com2024/08/22/hardcoded_credentials_bug_solarwinds_whdPress coverage, Third-party advisory
• pwn.watchpwn.watch: SolarWinds Web Help Desk Hardcoded Credentialpwn-watch
• NVD (NIST)NVD: CVE-2024-28987pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch