SolarWinds Web Help Desk Hardcoded Credentials Vulnerability Exploit

This vulnerability (CVE-2024-28987) is caused by the presence of hardcoded credentials in the application, allowing unauthenticated attackers to remotely read and modify all help desk ticket details. It enables authentication with a predefined account (helpdeskIntegrationUser/dev-C4F8025E7) Affected versions include SolarWinds Web Help Desk 12.8.3 Hotfix 1 and all previous versions. An attacker exploiting this vulnerability can: - Access the REST API without requiring valid credentials. - Retrieve sensitive information from support tickets. - Read private ticket details, including internal comments. - Access confidential data, such as shared account credentials or passwords from reset requests. - Modify existing tickets, altering their content or status. - Create new tickets with false or malicious information. This exploit leverages hardcoded credentials to authenticate via Basic Authentication and interact with the SolarWinds Web Help Desk API. Steps performed by the exploit: 1 Authentication to the API - Sends a Basic Authentication request to the /OrionTickets endpoint. - If the request returns ticket data, the target is confirmed to be vulnerable. 2 Retrieving help desk tickets - Fetches all available tickets from the system. 3 Creating a new ticket (optional) - If specified as a parameter, the exploit creates a new ticket in the system. - The ticket is generated with user-defined subject and details. 4 Saving tickets to a file (optional) - The retrieved tickets can be saved to a file if a path is provided. 5 Fetching additional ticket details (optional) - The exploit can request detailed information for each ticket.