Jimi Sebree

Metasploit · Author

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

Metasploit

SolarWinds Web Help Desk unauthenticated RCE

Metasploit exploitby sfewer-r7Added to Metasploit 2026-01-30ExploitCVE-2025-40536CVE-2025-405511 file

exploit_multi/http/solarwinds_webhelpdesk_rce · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit module that chains CVE-2025-40536 (access control bypass) and CVE-2025-40551 (unsafe deserialization) to achieve unauthenticated remote code execution on SolarWinds Web Help Desk. It establishes a session, bypasses auth, triggers deserialization via JSON-RPC, and delivers payloads through JNDI injection, SMB-hosted DLL, or cron file writes depending on the target version and platform.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit chain for CVE-2025-40536 and CVE-2025-40551 against SolarWinds Web Help Desk. All behavior is consistent with the stated purpose of achieving unauthenticated RCE via access control bypass and unsafe deserialization. No concealed, deceptive, or operator-directed harmful behavior unrelated to the exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareSolarWinds Web Help Desk
Attack typesremote_code_executiondeserializationauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete exploit that chains CVE-2025-40536 and CVE-2025-40551 to execute attacker-supplied payloads on the target. It includes all steps to bypass authentication, trigger deserialization, and deliver native or command payloads, and is classified as an exploit module in Metasploit.

modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:6modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:20-23modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:108-167

Requirements

  • Target must be a vulnerable SolarWinds Web Help Desk instance (12.7.* or 12.8.*).modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:44-78
  • Attacker must be able to reach the target's web interface (default TCP 8443).modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:82-83
  • For Windows 12.8.* targets, the attacker must be able to serve a DLL over SMB on TCP 445.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:185-186
  • For 12.7.* targets, the attacker must be able to serve a malicious LDAP response for JNDI injection.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:213

Observed behavior

  • Sends a GET request to /helpdesk/WebObjects/Helpdesk.woa with x-webobjects-recording header to obtain session tokens and version.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:293-299
  • Requests the LoginPref page to extract the externalAuthContainer URL, bypassing authentication.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:359-370
  • POSTs to the externalAuthContainer to trigger a SAML object, furthering the auth bypass.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:388-396
  • Creates a JSON-RPC bridge by requesting LoginPref again and extracting the JSONRpcClient endpoint.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:404-415
  • Sends JSON-RPC calls to wopage.setVariableValueForName and wopage.variableValueForName with malicious Java objects to trigger unsafe deserialization.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:442-477
  • Delivers payload via JNDI injection (12.7.*), SMB-hosted malicious DLL (12.8.* Windows), or cron file write (12.8.* Linux).modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:207-280
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
Payload withheldThe module's multi-step exploit flow (steps 1-5) matches the described vulnerabilities and uses standard Metasploit payload delivery mechanisms.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:20-24modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:108-148
Payload Delivery
Payload withheldThe module delivers attacker-chosen payloads via DLL over SMB, cron job creation, or JNDI lookup, all standard for the framework.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:195modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:213modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:277
Service Cleanup
Payload withheldThe module properly cleans up the temporary SMB share used for payload delivery, which is expected operational behavior.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:156-167
Review boundaries

What the analysis did not establish

  • Analysis is based on module source and metadata only; framework mixins, libraries, and external payloads are not expanded.
  • No network content was fetched; the module was not executed against a live target.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads referenced by the module are not included in the evidence.
  • Binary files were not inspected (metadata only).
  • The review does not assess the safety or reliability of the exploit or its payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.