Is this the start of a new trend in cyber warfare where Zero Day hackers can cover their tracks perfectly?

The US Cybersecurity and Infrastructure Security Agency (CISA) on 16 Aug (US time) issued a warning about a newly discovered critical vulnerability in the Web Help Desk of SolarWinds (affecting versions 12.4 through 12.8) that has been actively exploited without authentication.

The software in question is a web-based IT help desk solution that is used to centralize and automate ticketing management, curate a centralized knowledge base, and track and manage IT assets, among other functions. The vulnerability, identified as CVE-2024-28986 with a CVSS score of 9.8, involves a Java deserialization remote code execution flaw that could let attackers execute commands on the host system.

Two days earlier, the firm had actually released a hotfix to address this issue, specifying that exploitation of the vulnerability could only succeed if the hacker passed authentication. At that time, no instances of any active exploitation of the vulnerability had been found “under extensive testing”.

SolarWinds subsequently updated its advisory to indicate that the released hotfix should not be used if SAML Single Sign-On is utilized. Otherwise, the patch should, “out of an abundance of caution”, be applied as recommended, to Web Help Desk version 12.8.3.1813, and that users of earlier versions should upgrade promptly. Two satellite communications firms mentioned in the advisory (or their customers) as assisting in the preparation of the hotfix, have been speculated by security researchers to have been somehow affected. This speculation has yet to be verified.

CISA had included CVE-2024-28986 in its Known Exploited Vulnerabilities (KEV) catalog, suggesting that the vulnerability may have been exploited as a Zero Day vulnerability, with no specific details on the methodology or indicators of compromise. In line with Binding Operational Directive (BOD) 22-01, federal agencies in the USA are required to identify and patch affected SolarWinds Web Help Desk systems by 5 September.

Although this directive is specific to federal agencies, the CISA has recommended all organizations to review SolarWinds’ advisory and implement necessary fixes as soon as possible.