Unpatched Web Help Desk instances remain vulnerable to external attempts of attacks

Web Help Desk by SolarWinds has been exploited following the incoming instances of external attempts to attacks reported by the users that their EDR system has blocked. After this, Solar Winds started warning its users about the internet-exposed Web Help Desk instances, advising them to immediately remove it from any publicly accessible infrastructure as a safety measure to prevent any further exploitation.

Solar Winds further added that if any user is experiencing issues in immediately removing WHD instances from Internet-exposed servers are also advised to deploy Endpoint Detection & Response software to monitor them for any upcoming attempts of attacks.

WHD Vulnerabilities

While SolarWinds has yet to provide further details about the tactics, techniques, procedures (TTPs) of the attacks, here are the extended details of four security vulnerabilities an attacker could exploit to target a vulnerable Web Help Desk.

Access Restriction Bypass Via Referrer Spoof - Business Logic Bypass Vulnerability CVE-2021-32076 - Fixed in WHD 12.7.6
Enabled HTTP PUT & DELETE Methods CVE-2021-35243 - Fixed in WHD 12.7.7 Hotfix 1
Hard-coded credentials allowing HSQL queries execution CVE-2021-35232 - that was Fixed in WHD 12.7.7 Hotfix 1
Sensitive Data Disclosure Vulnerability(SDE) CVE-2021-35251 - Fixed in WHD 12.7.8

According to the CVE-2021-35251 advisory, threat actors will be able to exploit unpatched Web Help Desk instances in order to access environmental details about the Web Help Desk installation, making it even easier to exploit the rest of the three security vulnerabilities.

Unpatched Web Help Desk instances remain vulnerable to external attempts of attacks

Related threat feeds

Fake Google and Cloudflare Verification Pages Are Now a Seven Malware Delivery Pipeline

WHD Vulnerabilities

US Government Hit by Yet Another Cyberattack

Polymarket Hack Losses Rise to $3.1M Amid Refund Pledge