Wednesday, January 15, 2014

SoapUI Code Execution Vulnerability - CVE-2014-1202

In this blog post I will discuss a vulnerability I’ve found in the SoapUI product before version 4.6.4 (CVE-2014-1202).
I discovered this vulnerability during a penetration test in which I saw that the SoapUI software allows the clients to execute a Java code on the local machine by putting a Java code inside the following tag:

${=JAVA CODE};


The vulnerability allows the attacker to execute the java code on the victim's machine, thereby putting in danger the SoapUI users, including developers, penetration testers, etc.

The SoapUI product allows users to open a SOAP / REST project and import  WSDL/WADL files that help the users to communicate with the remote server easily.
WSDL/WADL files are XML-based grammar that define the operations that a web service offers and the format of the request and response messages that the client sends to and receives from the operations.
In WSDL/WADL files, the file owner can determine the default values of some parameters. Thus, an attacker can impersonate a legitimate web service and inject a malicious Java code into a default value of one of the parameters, and spread it to SoapUI clients.
When a SoapUI client will load a malicious WSDL/WADL file to his project in the SoapUI software, and send a request containing the malicious Java code, the SoapUI will execute the malicious Java code on the victim's computer.

The attack scenario:
1. An attacker impersonates a regular web service with a malicious WSDL containing the malicious Java code.
2. The victim creates a new project in the SoapUI and loads the malicious WSDL.
3. The victim decides to send a request to the remote server, thus, the SoapUI executes the malicious Java code.
4. The attacker succeeds in executing malicious code in the victim's machine and will take it over.

A Proof of Concept (PoC) video can be found at the following link:
                    
An example of a malicious WSDL file can be found at the following link:

21 comments:

  1. nice one!
    how did you discovered it btw? how is that code actually executed anyway?


    ReplyDelete
    Replies
    1. Thanks.
      The software allows the clients generate random numbers for dynamic properties and i noticed that its actually a Java code.
      The Java code executes when the client sends the request to the server.

      Delete
    2. I’m so excited my broken Marriage has been restored. “We recently made up, even though it was difficult. It’s been more than a month now, and everything feels like it’s returned to normal. He has began to treat me better, and it’s been a healing process for both of us. The nightmare that had lasted for almost 2 years before we broke up is finally over. It’s like we fell in love all over again! We’ve both put the past behind us, and are trying to move forward – and for the first time in a long time, the future looks a lot brighter. I can’t express in words how grateful I am Dr Great! It’s like we’ve finally rediscovered those things about each other that made us fall in love in the first place. All of the worrying and stress has simply vanished. Thank you Dr Great for saving my broken Marriage and brought my husband back to me!”. Me and my husband are living together happily again.. All thanks to Dr Great. If you have any problem contact Dr Great now and i guarantee you that he will help you contact him through

      infinitylovespell@gmail.com or infinitylovespell@yahoo.com

      WhatsApp +2348118829899

      website http://infinitylovespell.website2.me/

      blog http://infinitylovespell1.blogspot.com






      I’m so excited my broken Marriage has been restored. “We recently made up, even though it was difficult. It’s been more than a month now, and everything feels like it’s returned to normal. He has began to treat me better, and it’s been a healing process for both of us. The nightmare that had lasted for almost 2 years before we broke up is finally over. It’s like we fell in love all over again! We’ve both put the past behind us, and are trying to move forward – and for the first time in a long time, the future looks a lot brighter. I can’t express in words how grateful I am Dr Great! It’s like we’ve finally rediscovered those things about each other that made us fall in love in the first place. All of the worrying and stress has simply vanished. Thank you Dr Great for saving my broken Marriage and brought my husband back to me!”. Me and my husband are living together happily again.. All thanks to Dr Great. If you have any problem contact Dr Great now and i guarantee you that he will help you contact him through

      infinitylovespell@gmail.com or infinitylovespell@yahoo.com

      WhatsApp +2348118829899

      website http://infinitylovespell.website2.me/

      blog http://infinitylovespell1.blogspot.com







      I’m so excited my broken Marriage has been restored. “We recently made up, even though it was difficult. It’s been more than a month now, and everything feels like it’s returned to normal. He has began to treat me better, and it’s been a healing process for both of us. The nightmare that had lasted for almost 2 years before we broke up is finally over. It’s like we fell in love all over again! We’ve both put the past behind us, and are trying to move forward – and for the first time in a long time, the future looks a lot brighter. I can’t express in words how grateful I am Dr Great! It’s like we’ve finally rediscovered those things about each other that made us fall in love in the first place. All of the worrying and stress has simply vanished. Thank you Dr Great for saving my broken Marriage and brought my husband back to me!”. Me and my husband are living together happily again.. All thanks to Dr Great. If you have any problem contact Dr Great now and i guarantee you that he will help you contact him through

      infinitylovespell@gmail.com or infinitylovespell@yahoo.com

      WhatsApp +2348118829899

      website http://infinitylovespell.website2.me/

      blog http://infinitylovespell1.blogspot.com

      Delete
  2. My boyfriend broke up with me 2 months ago, because he felt i was cheating on him with a male friend of mine, i tried all i could to explain to him but he paid deaf ears, i was emotionally devastated because i really loved him until i saw a post on the internet about Dr osofo, who helps people gain back their lost lover, at first i doubted if it was real because i never believed in such things but i decided to give him a try,I contacted him and he told me what to do and i did it then he did a Love spell for me, he restored my relationship within 48 hours and my boyfriend was calling and begging to make up with me again, if you need help to repair your relationship or marriage problem. Here’s his contact, call/WhatsApp him on: +2349065749952, Emai   hi        ( osofo.48hoursolutioncenter@gmail.com )   

    ReplyDelete
  3. My boyfriend broke up with me 2 months ago, because he felt i was cheating on him with a male friend of mine, i tried all i could to explain to him but he paid deaf ears, i was emotionally devastated because i really loved him until i saw a post on the internet about Dr osofo, who helps people gain back their lost lover, at first i doubted if it was real because i never believed in such things but i decided to give him a try,I contacted him and he told me what to do and i did it then he did a Love spell for me, he restored my relationship within 48 hours and my boyfriend was calling and begging to make up with me again, if you need help to repair your relationship or marriage problem. Here’s his contact, call/WhatsApp him on: +2349065749952, Emai   hi        ( osofo.48hoursolutioncenter@gmail.com )   

    ReplyDelete
  4. I’m so excited my broken Marriage has been restored. “We recently made up, even though it was difficult. It’s been more than a month now, and everything feels like it’s returned to normal. He has began to treat me better, and it’s been a healing process for both of us. The nightmare that had lasted for almost 2 years before we broke up is finally over. It’s like we fell in love all over again! We’ve both put the past behind us, and are trying to move forward – and for the first time in a long time, the future looks a lot brighter. I can’t express in words how grateful I am Dr Great! It’s like we’ve finally rediscovered those things about each other that made us fall in love in the first place. All of the worrying and stress has simply vanished. Thank you Dr Great for saving my broken Marriage and brought my husband back to me!”. Me and my husband are living together happily again.. All thanks to Dr Great. If you have any problem contact Dr Great now and i guarantee you that he will help you contact him through

    infinitylovespell@gmail.com or infinitylovespell@yahoo.com

    WhatsApp +2348118829899

    website http://infinitylovespell.website2.me/

    blog http://infinitylovespell1.blogspot.com

    ReplyDelete
  5. AFRICAN TRADITIONAL METHODS OF CURING HERPES THAT IS GOING VIRAL!
    Most traditional methods of roots and herbs today have been scientifically proven to cure almost all drugs resistant diseases without after effect.
    It worked for me years ago when I was depressed with herpes. After trying numerous other methods, It was actually an old Ibo lady who brought to my notice the healing effect of natural medicines. She too was permanently cured from HERPES long time ago through Dr Utu @ "drutuherbalcure@gmail.com" who among few, specialises in African roots and herbs for medicinal cure. Apparently roots and herbs have well been known as effective key treatment for herpes. She introduced me to Dr Utu who till date remain my savior, and he truly cleared my doubt. After taking his medication on the fourth week, I contacted him again who asked me to go for test and I was negative. From then till now I do my normal business no outbreak. I may not be a herbal fan but it definitely worked for me!

    ReplyDelete
  6. I'm very happy being Herpes free now. It was a sad incident that was announced to me after the check up in the hospital and I was diagnosed of HSV 2. I thank God now for using Dr.odey Abang to cure my virus. I'm not ashamed to say this because no virus of such can be detected in me. I'm Charlotte from Columbia. I thought about it many Times when I heard about this Herbal cures for Herpes. I was really happy when I came across blogs of comments of Doctors who run cures sicknesses and was comfortable to try Dr. Abang from patients testimony I came across here on my online page. I knew now they are real Africa herbalists who run cures for Herpes. There's every opportunity to be cure with natural herbs, because all medical prescriptions are derived from herbs and roots. Its really hard time living with Herpes on drugs which can't get you cure. I tried this and I can boost of myself now as a woman. I need to be loved not to lost, get your instant cure to all sicknesses from Dr, Odey Abang.
    He cures HSV,HPV,Cancer,low spam count and much more from the evidence I saw 💯 % sure no site effects with active immune booster

    Email him for you cure
    Odeyabangherbalhome@gmail.com
    WhatsApp/calls
    +2349015049094

    ReplyDelete
  7. Hello everyone i am here to share a testimony of how Dr.Thomas herbal mixture cream saved me from  shame i have tryed so many ways everywhere until when i saw a testimony of how Dr.Thomas herbal mixture cream have been helping people regarding their sex life, so i decided to give him a try and to my greatest surprise in less than TEN DAYS of taking the herbs my penis grow to 7 inches i couldn't believe my eyes and as i speak now my penis is now 9 inches and i do not have week erection again. I can make love to my wife longer in bed. And my marriage is now stable,my wife now enjoy me very well in bed. you can contact him for more information's.(Doctorthomas73@gmail.com) or call or what-apps him through +2348152190329. he also specialize on the following things 1. CANCER
    2. ALS (Lou Gehrig's disease)
    3. COPD (chronic obstructive pulmonary disease) 
    Thank you sir, you indeed save me. 

    ReplyDelete
  8. Thank you sir for your genuine spells. This is really incredible, and I have never experienced anything like this in my life. Before i met you Sir, i have tried every possible means that i could to get my wife back, but i actually came to realize that nothing was working out for me, and that my wife had developed lot of hatred for me.. I thought there was no hope to reunite with my ex wife and kids. But when i read good reviews about your work sir, i decided to give it a try and i did everything that you instructed me and i Trusted in you and followed your instructions just as you have guaranteed me in 48 hours, and that was exactly when my wife called me.. We are more contented now than ever. Everything looks perfect and so natural! Thank you so much for your authentic and indisputable spells. Thanks Sir for your help. So I promise to tell the world about you great If you need help in your marriage of broken relationship,please contact Dr Osasu right now for urgent help WhatsApp +2347064365391 or Email drosasu25@gmail. com I want every one who is facing any problem should also give a testimony soon. Just like me today

    ReplyDelete
  9. WHAT A GREAT MIRACLE THAT I HAVE EVER SEE IN MY LIFE. My names are Clara David I’m a citizen of USA, My younger sister was sicking of breast cancer and her name is Sandra David I and my family have taking her to all kind of hospital in USA still yet no good result. I decided to make search for cancer cure so that was how I find a lady called peter Lizzy she was testifying  to the world about the goodness of a herbal man who has the roots and herbs to cure all kind of disease and the herbal man email was there. So I decided to contact the herbal man @herbalist_sakura for my younger sister help to cure her breast cancer. I contacted him and told him my problem he told me that I should not worry that my sister cancer will be cure, he told me that there is a medicine that he is going to give me that I will cook it and give it to my sister to drink for one week, so I ask how can I receive the cure that I am in USA, he told me That I will pay for the delivery service. The courier service can transport it to me so he told me the amount I will pay, so my dad paid for the delivery fee. two days later I receive the cure from the courier service so I used it as the herbal man instructed me to, before the week complete my sister cancer was healed and it was like a dream to me not knowing that it was physical I and my family were very happy about the miracle of Doctor so my dad wanted to pay him 5 million us dollars the herbal man did not accept the offer from my dad, but I don't know why he didn't accept the offer, he only say that I should tell the world about him and his miracle he perform so am now here to tell the world about him if you or your relative is having any kind of disease that you can't get from the hospital please contact dr.sakuraspellalter@gmail.com or whats app him +2348110114739  you can follow him up on Instagram @herbalist_sakura for the cure, he will help you out with the problem. And if you need more information about the doctor you can mail me davidclara223@gmail.com 

    ReplyDelete
  10. AM SO HAPPY THAT  FINELY AM FREE FROM HERPES SIMPLEX VIRUS WITH THE HELP OF DR ASIKA ABUMERE REMEDIES, YOU CAN MAKE AN ORDER TODAY FOR YOUR HEALTH TO BE FREE,  

      If you think you have Herpes, or HIV, or any kind of disease or infections  contact  Dr ASIKA ABUMERE  REMEDIES  need to act fast. If you need  treatment immediately, you can reduce the duration of your outbreak. The key is to start medication within 12 to 24 hours of noticing symptoms.•• ☘️Herpes has No medical cure but there is a Natural Remedy which cures it completely.within the period of two weeks This treatment is completely made from natural roots and herbs and dose not have any side effects, l'm sure you have been told that it has no cure but don't you think this is something you have to give a try remember a problem shared is a problem solved Kindly send a DM  Dr ASIKA ABUMERE REMEDIES  for more info about treatment or Contact him via WhatsApp +2348132311083 or Email him via ( drasikaabumereherbalhome@gmail.com )  privately.

    ReplyDelete

  11. I am so Happy to be writing this article in here, i am here to explore blogs forum about the wonderful and most safe cure for HERPES SIMPLEX VIRUS.I was positive to the Virus called HERPES and i lost hope completely because i was rejected even by my closet friends. i searched online to know and inquire about cure for HERPES and i saw testimony about DR Ebhota online on how he cured so many persons from Herpes Disease so i decided to contact the great herbalist because i know that nature has the power to heal everything. i contacted him to know how he can help me and he told me never to worry that he will help me with the natural herbs from God! after 2 days of contacting him, he told me that the cure has been ready and he sent it to me via FEDEX or DHL and it got to me after 4 days! i used the medicine as he instructed me (MORNING and EVENING) and i was cured! its really like a dream but i'm so happy! that's the reason i decided to also add more comment of Him so that more people can be saved just like me! and if you need his help,contact his Email: (drebhotasoltion@gmail.com) You can contact him on WhatsApp +2348089535482 He also have the herb to cure difference cure for any sickness (1) HERPES,
    (2) DIABETES,
    (3) HIV&AIDS,
    (4) URINARY TRACT INFECTION,
    (5) HEPATITIS B,
    (6) IMPOTENCE,
    (7) BARENESS/INFERTILITY
    (8) DIARRHEA
    (9) ASTHMA..

    ReplyDelete