New “SOAPwn” .NET Flaws Expose Barracuda, Ivanti, and Microsoft Devices to RCE
## Cybersecurity: Vulnerability in .NET Framework's HTTP Client Proxy
Cybersecurity: Vulnerability in .NET Framework's HTTP Client Proxy
Security researchers have identified a significant vulnerability series within the .NET Framework's HTTP client proxy architecture, known as "SOAPwn." This flaw allows remote code execution across various enterprise platforms.
The research, presented at Black Hat Europe 2025 by Piotr Bazydlo, highlights a design flaw in the framework's SOAP client proxies and WSDL imports. The issue arises from an invalid cast in the HttpWebClientProtocol class, which improperly validates URLs in SOAP proxy methods. This vulnerability enables attackers to redirect requests to file system handlers, facilitating arbitrary file writes and code execution.
The research identified several affected enterprise solutions, including:
Barracuda Service Center RMM (CVE-2025-34392): A pre-authentication SOAP API method that allows unauthenticated attackers to invoke arbitrary WSDL methods, leading to remote code execution without credentials. Ivanti Endpoint Manager (CVE-2025-13659): Post-authentication exploitation risks for users with form-editing permissions. Additional affected platforms include Umbraco 8 CMS, Microsoft PowerShell, and SQL Server Integration Services.
The research, presented at Black Hat Europe 2025 by Piotr Bazydlo, highlights a design flaw in the framework's SOAP client proxies and WSDL imports.
Exploitation utilizes ServiceDescriptionImporter, a standard .NET Framework class for generating SOAP client proxies from WSDL definitions. Researchers showed that malicious WSDL files could gain complete control over generated proxy code, affecting method names, arguments, and target URLs. By using file:// protocol URLs, attackers can redirect SOAP requests to write directly to the filesystem, creating an arbitrary file write scenario.
Attackers may deploy ASPX webshells or CSHTML payloads through techniques like XML serialization and namespace injection. The absence of URL scheme validation in ServiceDescriptionImporter allows this framework-level exploitation, impacting all dependent applications.
Microsoft has not classified this as a framework vulnerability, placing the onus of input validation on application developers. Barracuda released hotfix 2025.1.1, while Ivanti and other vendors have independently deployed patches. It is advised that security teams prioritize updates for affected systems and review WSDL-consuming applications for similar vulnerabilities.
Based on reporting by GBHackers.