Cyber

What changed

The SolarWinds Web Help Desk has been identified with a serious vulnerability related to the deserialization of untrusted data. This flaw allows unauthenticated attackers to exploit the AjaxProxy component, leading to potential remote code execution on the host system.

This vulnerability is particularly concerning as it serves as a patch bypass for previously addressed vulnerabilities, namely CVE-2024-28988 and CVE-2024-28986.

Who is affected

Organizations utilizing SolarWinds Web Help Desk are at risk, especially those that have not yet applied the latest security updates.

The vulnerability can impact a wide range of users, including IT departments, managed service providers, and any enterprise relying on this software for ticketing and support.

• SolarWinds Web Help Desk users
• IT departments managing support systems
• Managed service providers using SolarWinds solutions
• Enterprises with critical operations relying on this software

What to do

Security teams should prioritize assessing their environments for the presence of SolarWinds Web Help Desk and ensure that all necessary patches are applied immediately.

Monitoring for unusual activity on affected systems is also recommended to detect any potential exploitation attempts.

• Apply the latest patches from SolarWinds without delay.
• Conduct a thorough review of system logs for any signs of exploitation.
• Implement additional security measures such as network segmentation to limit exposure.
• Stay informed on updates from SolarWinds and relevant security advisories.

What changed

A severe command injection vulnerability has been identified in the tj-actions/branch-names GitHub Action. This flaw allows for arbitrary command execution in downstream workflows due to inconsistent input sanitization and unescaped output.

Malicious actors can exploit this vulnerability by crafting specific branch names or tags, leading to potential unauthorized command execution.

Who is affected

Organizations utilizing the tj-actions/branch-names GitHub Action are at risk of this vulnerability. The impact is particularly significant for those relying on automated workflows that process branch names or tags.

Developers and teams using GitHub Actions for CI/CD pipelines should be aware of this issue to mitigate risks.

• GitHub Action users employing tj-actions/branch-names.
• Organizations with automated workflows that handle branch names.
• Development teams integrating GitHub Actions into their CI/CD processes.

What to do

It is crucial for affected users to review their workflows and implement necessary changes to mitigate the risks associated with this vulnerability. Immediate actions should include updating the tj-actions/branch-names to the latest version where the vulnerability is addressed.

Additionally, consider implementing stricter input validation and output sanitization in your workflows to prevent potential exploitation.

• Update tj-actions/branch-names to the latest secure version.
• Review and enhance input validation mechanisms in workflows.
• Monitor for any unusual activity in workflows that may indicate exploitation attempts.