CVE-2025-40536 CrowdStrike LogScale · LogScale

Detect SolarWinds Web Help Desk Security Control Bypass (CVE-2025-40536) in CrowdStrike LogScale

Detects exploitation of CVE-2025-40536, a security control bypass vulnerability (CWE-693) in SolarWinds Web Help Desk. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass authentication or authorization controls within the Web Help Desk application. Successful exploitation may enable unauthorized access to ticketing data, credential stores, or administrative functions.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Credential Access

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#repo=base_activity
NetworkConnect
| filter RemotePort in (80, 443, 8080, 8443)
| filter ImageFileName matches "(?i)java|tomcat|whd|helpdesk"
| join kind=inner (
    HttpRequest
    | filter Url matches "(?i)/helpdesk/|/WebHelpDesk/|/whd/"
    | filter HttpMethod in ("PUT", "DELETE", "PATCH")
      or Url matches "(?i)bypass|admin|config|setup|security|%2e%2e|\.\./"
    | filter HttpStatusCode >= 200 and HttpStatusCode < 300
  ) on aid, ContextProcessId
| project timestamp, aid, UserName, RemoteAddressIP4, Url, HttpMethod, HttpStatusCode, ImageFileName, CommandLine
| sort timestamp desc
high severity medium confidence

CrowdStrike CQL query correlating network connections from Java/Tomcat processes hosting SolarWinds Web Help Desk with suspicious HTTP request patterns, helping identify potential bypass exploitation on the endpoint itself.

Data Sources

CrowdStrike Falcon endpoint telemetrynetwork connection eventsHTTP request events

Required Tables

base_activityNetworkConnectHttpRequest

False Positives & Tuning

  • Legitimate WHD administrative sessions by IT staff from known workstations
  • Authorized API integrations running on managed endpoints that use non-standard HTTP methods
  • Security tooling or scanners running on monitored endpoints performing WHD assessments
  • Java-based automation tools that legitimately interact with WHD REST endpoints

Other platforms for CVE-2025-40536

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated Access to WHD Admin Endpoint

    Expected signal: HTTP request to WHD ticket creation endpoint without session cookie; response code 200 or redirect to a normally-protected resource instead of 401/403

  2. Test 2HTTP Method Bypass Probe Against WHD API

    Expected signal: HTTP PUT request to WHD REST API ticket endpoint without valid session; response code 200 or 204 indicating the operation succeeded without authentication

  3. Test 3Path Traversal Bypass Attempt on WHD Configuration Endpoint

    Expected signal: HTTP GET request containing path traversal sequence /../ targeting WHD admin path; 200 response code indicating bypass of path-level access control

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP(s) triggering the detection and determine whether they are internal, VPN-connected, or external. Cross-reference with authorized WHD administrator IP allowlists.
  2. Review the full HTTP request logs for the triggering session: examine URI paths, query parameters, HTTP methods, and response bodies. Look for successful access to /admin/, /config/, /security/, or /setup/ paths that would not normally be accessible without authentication.
  3. Check SolarWinds Web Help Desk application logs (whd.log, access logs) for authentication bypass indicators such as missing session tokens, empty credential fields, or successful responses to normally-gated API endpoints.
  4. Determine the WHD version in use and confirm whether the instance is running a version prior to WHD 2026.1, which contains the patch for CVE-2025-40536.

Containment

  1. If active exploitation is confirmed, immediately isolate the SolarWinds Web Help Desk server from the network or place it behind an emergency firewall rule blocking external access. Notify stakeholders of the temporary service outage.
  2. Rotate all WHD service account credentials, API keys, and any credentials stored within WHD (e.g., monitored device credentials, email service accounts) as these may have been exfiltrated through the bypass vulnerability.
  3. Apply the SolarWinds WHD 2026.1 patch or the vendor-provided hotfix immediately. Verify patch integrity against the SolarWinds trust center checksum before installation.

Evidence Collection

  1. Collect and preserve the following WHD application logs before any patching or restart: whd.log, access logs (IIS/Tomcat), catalina.out (if Tomcat-based), and any WAF/proxy logs covering the incident timeframe.
  2. Capture a memory dump and disk image of the WHD server if the attacker may have achieved code execution, to preserve forensic evidence of any webshells, persistence mechanisms, or exfiltrated data.
  3. Export WHD database query logs to identify any unauthorized data access, ticket exfiltration, or credential queries that occurred during the exploitation window.

Escalation Criteria

  • !Escalate immediately to incident response if the attacker accessed or modified WHD tickets containing sensitive business data, credentials, or PII — particularly if WHD is used to manage privileged access requests.
  • !Escalate if post-exploitation indicators are present: new admin accounts created in WHD, unexpected outbound connections from the WHD server, or evidence of lateral movement using credentials stored in WHD (e.g., monitored device passwords).

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >SolarWinds WHD application log: whd.log — look for authentication bypass patterns, unauthenticated API calls, or unexpected admin-tier responses
  • >IIS/Tomcat access logs: HTTP 200 responses to /admin/, /config/, or /security/ endpoints without a corresponding authenticated session cookie
  • >WHD database (MySQL/MSSQL): query history for SELECT on tech/admin tables, new user creation, or credential-related tables during the incident window
  • >Network flow records: unusual volume of requests from a single external IP to WHD ports, or data exfiltration patterns (large outbound transfers following exploitation)

Tuning Guidance

Tune detection by building a baseline of authorized WHD administrator source IPs and service account usernames. Add these to an exclusion list to reduce false positives from legitimate admin activity. Additionally, establish a known-good list of HTTP methods per endpoint type (e.g., only GET/POST on /helpdesk/tickets/) and alert only on deviations. If a WAF is deployed in front of WHD, correlate WAF block/allow events with application access logs to distinguish bypass attempts from blocked probes. Increase confidence to 'high' once WHD version is confirmed as unpatched.

Hunting Queries

Threat hunt for unauthenticated successful access to sensitive SolarWinds WHD admin/config endpoints — a key indicator of security control bypass exploitation where the vulnerability allows bypassing authentication checks.

Hunting — KQL
kql 
W3CIISLog
| where csUriStem has_any ("/helpdesk/", "/WebHelpDesk/", "/whd/")
| where scStatus between (200 .. 299)
| where csUriStem has_any ("/admin/", "/config/", "/setup/", "/security/", "/api/")
| where isempty(csUsername) or csUsername == "-"
| summarize request_count=count(), uri_paths=make_set(csUriStem), methods=make_set(csMethod) by cIP, bin(TimeGenerated, 1h)
| where request_count >= 2
| sort by request_count desc
Hunting — SPL
spl 
index=* (sourcetype=iis OR sourcetype=solarwinds:whd)
| where (uri_path LIKE "%/helpdesk/%" OR uri_path LIKE "%/WebHelpDesk/%" OR uri_path LIKE "%/whd/%")
| where (uri_path LIKE "%/admin/%" OR uri_path LIKE "%/config/%" OR uri_path LIKE "%/setup/%" OR uri_path LIKE "%/security/%")
| where status IN ("200","201","204")
| where isnull(username) OR username="-"
| stats count AS hits, values(uri_path) AS accessed_paths BY src_ip
| where hits >= 2
| sort - hits

Atomic Red Team Tests

Test 1 Unauthenticated Access to WHD Admin Endpoint
linux

Simulate a security control bypass by sending an unauthenticated HTTP request directly to a SolarWinds Web Help Desk administrative endpoint, bypassing normal session-based authentication.

Command

bash 
curl -v -X GET 'http://TARGET_WHD_HOST:8080/helpdesk/WebObjects/Helpdesk.woa/wa/TicketActions/create' -H 'Accept: application/json' --cookie '' 2>&1 | grep -E 'HTTP/|Location:|Set-Cookie:|\{|\}'

Cleanup

bash 
No cleanup required — read-only probe. Review WHD access logs to confirm the request was recorded.

Expected Telemetry

HTTP request to WHD ticket creation endpoint without session cookie; response code 200 or redirect to a normally-protected resource instead of 401/403

Expected Detection

Web access log entry showing GET to /helpdesk/ admin path with empty/absent authentication header and 2xx response; triggers the unauthenticated admin access hunting query

Test 2 HTTP Method Bypass Probe Against WHD API
linux

Attempt to invoke a write operation on a WHD REST API endpoint using an HTTP method (PUT) that the security control may not properly restrict, simulating CWE-693 exploitation.

Command

bash 
curl -v -X PUT 'http://TARGET_WHD_HOST:8080/helpdesk/WebObjects/Helpdesk.woa/ra/Tickets/1' -H 'Content-Type: application/json' -d '{"statustype":{"id":2}}' --cookie '' 2>&1

Cleanup

bash 
If the request succeeds and modifies a test ticket, revert ticket status via the WHD admin UI. Check WHD logs for the event.

Expected Telemetry

HTTP PUT request to WHD REST API ticket endpoint without valid session; response code 200 or 204 indicating the operation succeeded without authentication

Expected Detection

IIS/Tomcat access log shows PUT method to /helpdesk/ path with 200/204 response and no username; CQL/SPL/KQL detection fires on method+path+status combination

Test 3 Path Traversal Bypass Attempt on WHD Configuration Endpoint
windows

Probe SolarWinds WHD for security control bypass using URL path traversal sequences to reach protected configuration endpoints without a valid session.

Command

powershell 
Invoke-WebRequest -Uri 'http://TARGET_WHD_HOST:8080/helpdesk/WebObjects/Helpdesk.woa/wa/../admin/AdminActions/listAll' -Method GET -Headers @{'Accept'='application/json'} -UseBasicParsing 2>&1 | Select-Object StatusCode, Content

Cleanup

powershell 
No cleanup required — read-only probe. Verify the request appears in WHD access logs and does not leave persistent artifacts.

Expected Telemetry

HTTP GET request containing path traversal sequence /../ targeting WHD admin path; 200 response code indicating bypass of path-level access control

Expected Detection

Web access log captures URL with %2e%2e or ../ sequence targeting /admin/ path with 2xx response; Chronicle YARA-L and KQL rules fire on URL pattern match

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1556Modify Authentication ProcessT1213Data from Information Repositories

Same Tactic: Initial Access

Popular Detections