CVE-2024-28986
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Description
CVE-2024-28986 is a critical Java deserialization remote code execution vulnerability (CVSS 9.8) in SolarWinds Web Help Desk, an IT service management and help desk ticketing platform. The vulnerability allows an attacker to execute arbitrary commands on the host machine by exploiting insecure Java deserialization. While initially reported as unauthenticated, SolarWinds noted they could not reproduce it without authentication, though they issued a patch out of caution. Affecting Web Help Desk versions 12.8.3 and earlier, this vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 75.13% (98.8th percentile) indicates an exceptionally high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | web help desk | <= 12.8.2; 12.8.3 |
References
- https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1(Broken Link, Vendor Advisory)
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28986(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28986(US Government Resource)
Weakness Type
Java Deserialization Remote Code Execution
This vulnerability exploits insecure Java deserialization in SolarWinds Web Help Desk. Java deserialization vulnerabilities occur when an application deserializes untrusted data without proper validation, allowing attackers to craft malicious serialized Java objects that execute arbitrary code when deserialized by the target application. This class of vulnerability has been responsible for numerous critical security incidents across Java-based enterprise applications. In the context of Web Help Desk, which is built on Java technology, the deserialization flaw can be triggered to execute operating system commands on the host machine with the privileges of the Web Help Desk application process. SolarWinds Web Help Desk is commonly deployed with elevated system privileges to manage IT service operations, making successful exploitation particularly impactful.
Impact Analysis
The CVSS score of 9.8 (Critical) reflects the maximum exploitability and high impact across all dimensions. Confidentiality impact is rated High, as remote code execution grants the attacker access to all data managed by Web Help Desk, including support tickets (which often contain sensitive information, passwords shared by users, and internal system details), customer data, employee information, and the underlying database. Integrity impact is also High, allowing attackers to modify help desk data, alter ticket workflows, create administrative accounts, or use the server as a pivot point for attacking other systems on the network. Availability impact is High, as attackers can disrupt help desk operations, corrupt data, or deploy destructive payloads.
The business implications are significant because Web Help Desk occupies a trusted position in IT infrastructure. Help desk systems frequently contain credentials that users share in support tickets, internal network documentation, system configurations, and sensitive employee information. The EPSS score of 75.13% (98.8th percentile) indicates that this vulnerability is far more likely to be exploited than the vast majority of CVEs. Its inclusion in the KEV catalog confirms active real-world exploitation. While the ransomware association is listed as unknown, SolarWinds products have historically been high-value targets for sophisticated attackers, as demonstrated by the 2020 SolarWinds supply chain attack. Organizations running Web Help Desk should treat this as an emergency-level threat.
Exploit Maturity
CVE-2024-28986 is confirmed as actively exploited in the wild through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 5, 2024. The EPSS score of 75.13% (98.8th percentile) places this vulnerability in the top tier of exploitation probability. SolarWinds published a security advisory and released a hotfix to address the vulnerability. The ambiguity around authentication requirements (reported as unauthenticated but reproducible only with authentication during SolarWinds' testing) adds complexity to the risk assessment, but the conservative approach of treating it as potentially unauthenticated is warranted given the active exploitation status. Java deserialization exploits are well-understood attack techniques with extensive tooling available (such as ysoserial), lowering the barrier for exploitation. The ransomware association is unknown, but the critical severity and SolarWinds' prominence as an IT management vendor make this a high-priority target.
Remediation
-
Apply the SolarWinds hotfix immediately — Install Web Help Desk 12.8.3 Hotfix 1 or upgrade to the latest available version. If running a version earlier than 12.8.3, upgrade to 12.8.3 first, then apply the hotfix. Follow SolarWinds' installation instructions carefully and back up the system before applying updates.
-
Restrict network access to Web Help Desk — Limit access to the Web Help Desk application to only authorized users and networks. Implement firewall rules to block external access if the application does not require internet-facing exposure. Use a reverse proxy or VPN for remote access scenarios.
-
Review and harden the Web Help Desk server — Ensure the Web Help Desk application runs with the minimum necessary system privileges. Review the server's security configuration, disable unnecessary services, and ensure the operating system is fully patched. Apply the principle of least privilege to the service account running Web Help Desk.
-
Audit for indicators of compromise — Review Web Help Desk application logs and system logs for unusual activities, including unexpected process spawning, unauthorized user creation, anomalous network connections, or suspicious Java exceptions related to deserialization. Check for newly created files, modified configurations, or scheduled tasks that could indicate post-exploitation activity.
-
Implement application-level monitoring — Deploy monitoring solutions that can detect Java deserialization attacks, such as web application firewalls (WAFs) with deserialization attack signatures, runtime application self-protection (RASP) tools, or endpoint detection and response (EDR) solutions configured to monitor the Web Help Desk process for abnormal behavior.
Technical Details
The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H presents the worst-case exploitability scenario. Attack Vector (Network) means the vulnerability is remotely exploitable. Attack Complexity (Low) indicates no special conditions are required. Privileges Required (None) reflects the original report of unauthenticated exploitation, though SolarWinds noted they could only reproduce it with authentication. User Interaction (None) allows fully automated attacks. All three impact categories are rated High.
The vulnerability is a Java deserialization flaw in SolarWinds Web Help Desk. Java deserialization attacks exploit the way Java applications reconstruct objects from serialized byte streams. When an application deserializes untrusted input, an attacker can craft a serialized object that, upon deserialization, triggers a chain of method calls (a "gadget chain") using classes available in the application's classpath. These gadget chains can ultimately execute arbitrary operating system commands. In Web Help Desk's case, the application accepts serialized Java objects through one or more of its network-facing interfaces. An attacker crafts a malicious serialized payload using known gadget chains from Java libraries present in the Web Help Desk installation (such as Apache Commons Collections, Spring Framework, or other common Java dependencies). When Web Help Desk deserializes this payload, the gadget chain executes, running arbitrary commands on the host machine with the privileges of the Web Help Desk Java process. The discrepancy between the reported unauthenticated exploitation and SolarWinds' authentication-required reproduction may indicate that the exploitation path varies depending on the deployment configuration, version, or specific endpoint targeted.
Frequently Asked Questions
What is CVE-2024-28986?
CVE-2024-28986 is a critical Java deserialization remote code execution vulnerability in SolarWinds Web Help Desk. It allows attackers to execute arbitrary commands on the host machine by exploiting insecure deserialization of Java objects. The vulnerability has a CVSS score of 9.8 and is actively exploited in the wild.
Does exploiting this vulnerability require authentication?
The vulnerability was initially reported as unauthenticated, but SolarWinds stated they could not reproduce it without authentication during testing. Out of caution, SolarWinds still issued a patch. Given the active exploitation confirmed by CISA, organizations should treat this as potentially exploitable without authentication and patch immediately.
Which versions of Web Help Desk are affected?
All versions of SolarWinds Web Help Desk up to and including 12.8.3 are affected. SolarWinds has released Hotfix 1 for version 12.8.3 to address the vulnerability. Organizations running earlier versions should first upgrade to 12.8.3 and then apply the hotfix.
What makes Java deserialization vulnerabilities so dangerous?
Java deserialization vulnerabilities allow attackers to execute arbitrary code on the target server by sending specially crafted serialized objects. The attack leverages existing Java classes in the application's libraries to build execution chains that run operating system commands. These attacks are reliable, well-tooled, and often provide full system access.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.