SolarWinds Web Help Desk Hardcoded Credentials Vulnerability (CVE-2024-28987) Critical Security Advisory

# 1. Stop the Web Help Desk service
sudo service webhelpdesk stop

# 2. Extract the Hotfix 2 package (Ensure you have downloaded the hotfix from the SolarWinds Customer Portal)
# wget -O whd_hotfix.zip '<SolarWinds_Download_URL>'
unzip whd_hotfix.zip -d /tmp/whd_patch

# 3. Backup existing binaries and apply the patch
cp /usr/local/webhelpdesk/bin/webhelpdesk.jar /usr/local/webhelpdesk/bin/webhelpdesk.jar.bak
cp /tmp/whd_patch/*.jar /usr/local/webhelpdesk/bin/

# 4. Restart the service and verify status
sudo service webhelpdesk start
sudo service webhelpdesk status

# Example Nginx configuration to restrict access to trusted subnets
# /etc/nginx/conf.d/whd.conf

server {
    listen 443 ssl;
    server_name whd.company.local;

    # Allow trusted internal subnets only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;

    location / {
        proxy_pass http://127.0.0.1:8081;
        proxy_set_header Host $host;
    }
}

# Audit access logs for suspicious endpoints and external IP addresses
grep -Ei '(/ra/|/helpdesk/WebObjects/|/SAML/)' /usr/local/webhelpdesk/logs/access_log* | grep -v '127.0.0.1'

# Verify the currently installed version of Web Help Desk
cat /usr/local/webhelpdesk/conf/version.properties 2>/dev/null || echo 'Version file not found'