Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))
PoC publicSolarWinds Web Help Desk Read at watchTowr Labs
Below is the opening; the full story is at watchTowr Labs.
From watchTowr Labs
It’s been a while, but we’re back - in time for story time.
Gather round, strap in, and prepare for another depressing journey of “all we wanted to do was reproduce an N-day, and here we are with 0-days”.
Today, friends, we’re looking at SolarWinds Web Help Desk, which has seen its fair share of in-the-wild exploitation and while purporting to be a help desk solution - has had far more attention for its ability to provide RCE opportunities, with a confidence-inspiring amount of “oh it’s basically the same thing again”.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.