Hardcoded Credential Vulnerability in SolarWinds Web Help Desk

This repository is a small standalone Python proof-of-concept exploit for CVE-2024-28987 affecting SolarWinds Web Help Desk. The repository contains 4 files total: one Python script (cve-2024-28987.py), a README, license, and .gitignore. The exploit is not part of a larger framework. The main script uses only Python standard library modules (urllib, json, base64, sys, os, re, urllib.parse). Its core purpose is to exploit hardcoded credentials in SolarWinds Web Help Desk by sending an HTTP GET request with a Basic Authorization header to the OrionTickets REST endpoint. If the endpoint returns accessible data, the script marks the target as vulnerable and stores the returned ticket data. Primary capabilities observed in the code and documentation: (1) vulnerability validation by attempting authenticated access with embedded credentials, (2) ticket enumeration and bulk retrieval from the target, (3) previewing a subset of tickets to the operator, (4) scanning ticket content for sensitive information such as passwords or other confidential data using pattern matching, and (5) optional export of all retrieved tickets to local JSON and JSONL files. The script also includes user-friendly console output, exception handling for common HTTP errors, and interactive prompting before saving data. The exploit targets SolarWinds Web Help Desk versions up to 12.8.3 Hotfix 1, with the README stating 12.8.3 Hotfix 2 as patched. The attack vector is remote over HTTP to the Web Help Desk service, typically shown on port 8098 in examples. The most important fingerprintable target artifact is the endpoint /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/, which is the resource used to retrieve ticket records. The exploit also embeds the hardcoded credentials helpdeskIntegrationUser / dev-C4F8025E7, which are central to the vulnerability. Overall, this is an operational exploit script rather than a mere detector: it both confirms exposure and extracts accessible ticket data from vulnerable systems.

This repository contains a proof-of-concept Python exploit for CVE-2024-28987, a hardcoded credential vulnerability in SolarWinds Web Help Desk. The main script, 'cve-2024-28987.py', uses a hardcoded HTTP Basic Authorization header to authenticate to the SolarWinds Web Help Desk API. It retrieves up to 25 of the most recent help desk tickets (due to an API limitation), fetches full details for each ticket, and saves the results in a structured directory format. The script also analyzes ticket IDs to estimate the total number of tickets in the system. Output is organized into JSON files for summaries and detailed ticket data. The exploit is network-based, targeting the API endpoints '/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets' and '/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/{ticket_id}' on the victim system. The repository includes a README with usage instructions and a LICENSE file. The exploit does not provide a shell or code execution, but enables unauthorized access to sensitive ticket data via the exposed API.

This repository contains a single Metasploit auxiliary module targeting SolarWinds Web Help Desk (<=12.8.3) via CVE-2024-28987. The module exploits a hardcoded backdoor account (helpdeskIntegrationUser:dev-C4F8025E7) to authenticate to the application's API endpoint and retrieve all ticket data in JSON format. The exploit connects over HTTPS (default port 8443), authenticates using the backdoor credentials, and dumps the ticket data, saving it to a local file (solarwinds_webhelpdesk.json). The module also reports the service and vulnerability to the Metasploit database. The code is written in Ruby and is structured as a standard Metasploit auxiliary module, with clear separation of initialization, authentication, and exploitation logic. No fake or destructive actions are present; the module is operational and focused on data extraction.

This repository contains a proof-of-concept exploit for CVE-2024-28987, a hardcoded credential vulnerability in SolarWinds Web Help Desk. The main file, CVE-2024-28987.py, is a Python script that takes a target URL as input and attempts to retrieve helpdesk tickets from the target by sending an HTTP GET request to the /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets endpoint. The request uses a hardcoded HTTP Basic Authorization header, exploiting the vulnerability to gain unauthorized access to ticket data. The script prints the retrieved tickets if successful, or indicates if the target is likely not vulnerable. The repository also includes a README.md with usage instructions and background information. No additional payloads or post-exploitation actions are present; the exploit is limited to reading ticket data. The attack vector is network-based, requiring access to the target's web interface.