SolarWinds Releases Hotfix for Hardcoded Credentials Flaw in Web Help Desk

SolarWinds has issued a crucial hotfix for its Web Help Desk (WHD) software to resolve severe security vulnerabilities, including a hardcoded credential issue and a remote code execution flaw. These vulnerabilities pose significant risks, potentially allowing unauthorized access and command execution on affected systems.

The particular hotfix is the second in a series of patches aimed at addressing critical security issues within the WHD platform. The first hotfix, 12.8.3 Hotfix 1, addressed a critical remote code execution vulnerability (CVE-2024-28986), which stemmed from a Java deserialization flaw. CISA warned in mid-August that this vulnerability was leveraged by hackers in actual attacks in the wild.

The newly released 12.8.3 Hotfix 2 builds upon the previous fix by addressing another severe flaw—CVE-2024-28987—a hardcoded credential vulnerability identified by security researcher Zach Hanley. This vulnerability could allow a remote, unauthenticated attacker to access internal functionalities of the WHD software and modify critical data. The vulnerability is rated with a severity score of 9.1, underscoring the urgent need for users to apply the update.

Impact on SolarWinds Web Help Desk

SolarWinds Web Help Desk is a widely used IT service management software that helps organizations streamline their support processes. Given its extensive deployment across various sectors, the discovery of hardcoded credentials represents a significant security concern. The potential for remote code execution and unauthorized access highlights the critical nature of these security flaws, necessitating immediate action by all users.

Implementing the hotfix

To address these issues, SolarWinds has provided detailed instructions for applying the hotfix. The patch involves modifying several core files within the WHD installation directory, including the addition of a new security-related JAR file (whd-security.jar) and updates to existing files (whd-core.jar and whd-web.jar). Additionally, administrators are required to manually adjust the tomcat_server_template.xml file to reinforce security patterns within the WHD application.

The hotfix requires that users have either Web Help Desk version 12.8.3.1813 or 12.8.3 Hotfix 1 installed before applying the new update. SolarWinds emphasizes the importance of backing up existing files before proceeding with the installation to ensure a smooth update process.

Given the critical nature of these vulnerabilities, SolarWinds strongly recommends that all organizations using Web Help Desk apply the hotfix immediately. Failure to do so could leave systems vulnerable to exploitation, potentially compromising sensitive data and disrupting essential IT operations.