SolarWinds Web Help Desk Security Control Bypass (CVE-2025-40536)

union isfuzzy=true
(
  CommonSecurityLog
  | where DeviceVendor =~ "SolarWinds" or DeviceProduct has_any ("WebHelpDesk", "Web Help Desk", "WHD")
  | where Activity has_any ("bypass", "unauthorized", "403", "401", "security control")
  | project TimeGenerated, DeviceVendor, DeviceProduct, Activity, SourceIP, DestinationIP, AdditionalExtensions
),
(
  W3CIISLog
  | where csUriStem has_any ("/helpdesk/", "/WebHelpDesk/", "/whd/")
  | where scStatus in (200, 201, 204) and (csUriQuery has_any ("bypass", "admin", "config", "../", "%2e%2e") or csMethod in ("PUT", "DELETE", "PATCH"))
  | project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, csMethod, csUsername
),
(
  AzureActivity
  | where OperationNameValue has_any ("bypass", "unauthorized access")
  | where ResourceProviderValue has "SolarWinds"
  | project TimeGenerated, CallerIpAddress, OperationNameValue, ResourceGroup
)
| extend Severity = "High"
| extend CVE = "CVE-2025-40536"

index=* sourcetype IN ("solarwinds:whd", "iis", "apache_access", "nginx:plus:kv", "solarwinds:helpdesk")
| eval is_whd_path=if(match(uri_path, "(?i)/helpdesk/|/WebHelpDesk/|/whd/"), 1, 0)
| eval suspicious_bypass=if(
    match(uri_query, "(?i)bypass|admin|config|%2e%2e|\.\.[\/]") OR
    method IN ("PUT", "DELETE", "PATCH") OR
    status IN ("200", "201") AND match(uri_path, "(?i)/(admin|setup|config|security)/"),
    1, 0)
| where is_whd_path=1 AND suspicious_bypass=1
| eval cve="CVE-2025-40536"
| stats count AS request_count, values(uri_path) AS paths, values(method) AS methods, values(status) AS statuses, dc(src_ip) AS unique_src_ips BY src_ip, dest_ip, cve
| where request_count >= 3
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where destination.port in (8080, 8443, 443, 80) and
   url.path : ("/helpdesk/*", "/WebHelpDesk/*", "/whd/*") and
   http.request.method in ("PUT", "DELETE", "PATCH") and
   http.response.status_code in (200, 201, 204)]
  [network where destination.port in (8080, 8443, 443, 80) and
   url.path : ("/helpdesk/*", "/WebHelpDesk/*", "/whd/*") and
   (url.query : ("*bypass*", "*admin*", "*../*", "*%2e%2e*") or
    url.path : ("*/admin/*", "*/setup/*", "*/config/*", "*/security/*"))]

SELECT
  sourceip,
  destinationip,
  URL,
  'HTTP_Method' AS method,
  'HTTP_Status_Code' AS status_code,
  starttime,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LAST 24 HOURS
  AND (
    (URL ILIKE '%/helpdesk/%' OR URL ILIKE '%/WebHelpDesk/%' OR URL ILIKE '%/whd/%')
    AND (
      URL ILIKE '%bypass%' OR
      URL ILIKE '%../% ' OR
      URL ILIKE '%admin%' OR
      URL ILIKE '%config%' OR
      URL ILIKE '%setup%' OR
      'HTTP_Method' IN ('PUT', 'DELETE', 'PATCH')
    )
    AND 'HTTP_Status_Code' IN ('200', '201', '204')
  )
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=*solarwinds* OR _sourceCategory=*helpdesk* OR _sourceCategory=*whd* OR _sourceCategory=*iis*
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "(?<method>GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS) (?<uri_path>/[^\s]*)" nodrop
| parse regex "HTTP/[\d\.]+\" (?<status_code>\d{3})" nodrop
| where uri_path matches "/helpdesk/*" or uri_path matches "/WebHelpDesk/*" or uri_path matches "/whd/*"
| where (method in ("PUT","DELETE","PATCH") and status_code in ("200","201","204"))
   or uri_path matches "*admin*"
   or uri_path matches "*config*"
   or uri_path matches "*bypass*"
   or uri_path matches "*../*"
| count by src_ip, method, uri_path, status_code
| where _count >= 2
| sort by _count desc

rule cve_2025_40536_solarwinds_whd_bypass {
  meta:
    author = "df00tech detection engineering"
    description = "Detects SolarWinds Web Help Desk security control bypass CVE-2025-40536"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536"
    cve = "CVE-2025-40536"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      $e.target.url = /\/helpdesk\// nocase or
      $e.target.url = /\/WebHelpDesk\// nocase or
      $e.target.url = /\/whd\// nocase
    )
    (
      $e.network.http.method = "PUT" or
      $e.network.http.method = "DELETE" or
      $e.network.http.method = "PATCH" or
      $e.target.url = /bypass/ nocase or
      $e.target.url = /\/admin\// nocase or
      $e.target.url = /\/config\// nocase or
      $e.target.url = /\.\.\// nocase or
      $e.target.url = /%2e%2e/ nocase
    )
    $e.network.http.response_code >= 200
    $e.network.http.response_code < 300

  condition:
    $e
}

#repo=base_activity
NetworkConnect
| filter RemotePort in (80, 443, 8080, 8443)
| filter ImageFileName matches "(?i)java|tomcat|whd|helpdesk"
| join kind=inner (
    HttpRequest
    | filter Url matches "(?i)/helpdesk/|/WebHelpDesk/|/whd/"
    | filter HttpMethod in ("PUT", "DELETE", "PATCH")
      or Url matches "(?i)bypass|admin|config|setup|security|%2e%2e|\.\./"
    | filter HttpStatusCode >= 200 and HttpStatusCode < 300
  ) on aid, ContextProcessId
| project timestamp, aid, UserName, RemoteAddressIP4, Url, HttpMethod, HttpStatusCode, ImageFileName, CommandLine
| sort timestamp desc