SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

id: CVE-2025-26399

info:
  name: SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE
  author: popy21
  severity: critical
  description: |
    SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges.
  impact: |
    Attackers can execute arbitrary commands on the host machine remotely without authentication, leading to full system compromise.
  remediation: |
    Update to the latest version that addresses this vulnerability.
  reference:
    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
    - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26399
    - https://labs.watchtowr.com/buy-a-help-desk-bundle-a-remote-access-solution-solarwinds-web-help-desk-pre-auth-rce-chain-s/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-26399
    cwe-id: CWE-502
    epss-score: 0.88330
    epss-percentile: 0.99757
    cpe: cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: solarwinds
    product: web_help_desk
    cisa-kev: true
    shodan-query: http.favicon.hash:"1895809524"
    fofa-query: icon_hash="1895809524"
  tags: cve,cve2025,solarwinds,webhelpdesk,deserialization,rce,kev,vkev,passive

http:
  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "Web Help Desk Software", "SolarWinds WorldWide", "HCS Web Help Desk")'
          - 'compare_versions(version, "< 12.8.7")'
        condition: and

    extractors:
      - type: regex
        name: build_token
        part: body
        group: 1
        regex:
          - "\\?v=([0-9]+_[0-9]+_[0-9]+_[0-9]+)"
        internal: true

      - type: dsl
        name: version
        dsl:
          - 'replace(build_token, "_", ".")'
# digest: 490a0046304402207d00f47d3f4e12adc279d132d57106f2af3306b8cdf4db46ef826b878a28a96e02200c9c722de008a97ee192b9ff6e6f6c8fbcc0f1b38d1c9825a5658afab62b5502:922c64590222798bb761d5b6d8e72950