New “SOAPwn” .NET Vulnerabilities Expose Barracuda, Ivanti and Microsoft Appliances to RCE Attack
Recent research into legacy .NET Framework SOAP client code has revealed a class of vulnerabilities known as "SOAPwn," which can be exploited for remote code execution (RCE) across various enterprise products. Affected products include Barracuda Service…
Recent research into legacy .NET Framework SOAP client code has revealed a class of vulnerabilities known as "SOAPwn," which can be exploited for remote code execution (RCE) across various enterprise products. Affected products include Barracuda Service Center RMM, Ivanti Endpoint Manager, Umbraco CMS 8, Microsoft PowerShell, and SQL Server Integration Services.
Technical Details of SOAPwn Vulnerabilities
These vulnerabilities were presented by Piotr Bazydlo at Black Hat Europe 2025. The vulnerabilities originate from how .NET's SOAP HTTP client proxies handle URLs. The affected proxy classes (SoapHttpClientProtocol, DiscoveryClientProtocol, and HttpSimpleClientProtocol) inherit from HttpWebClientProtocol, which internally uses WebRequest.Create(uri) without enforcing HTTP-only schemes. If an attacker can manipulate the URL property, either directly or via WSDL imports, the proxy may switch from HTTP to file:// or UNC paths, transforming a network SOAP call into a local or remote file write.
This design flaw enables multiple attack vectors, including relaying NTLM by directing SOAP traffic to SMB shares. More critically, when combined with attacker-controlled WSDL and SOAP arguments, this behavior becomes an arbitrary-file-write primitive. Researchers have used this in real-world appliances to inject ASPX or CSHTML webshells or malicious PowerShell scripts into web-accessible paths, resulting in full RCE.
Several products have been identified as vulnerable:
Affected products include Barracuda Service Center RMM, Ivanti Endpoint Manager, Umbraco CMS 8, Microsoft PowerShell, and SQL Server Integration Services.
Barracuda Service Center RMM: Exposed a pre-authenticated SOAP method that dynamically imports WSDL, tracked as CVE-2025-34392 and patched in hotfix 2025.1.1. Ivanti Endpoint Manager: Exploitable via CSHTML payloads smuggled through namespaces in malicious WSDL files. Umbraco 8 CMS: Allows authenticated users with Forms permissions to define arbitrary web service data sources pointing to an attacker's WSDL. Microsoft PowerShell and SQL Server Integration Services: Vulnerable when consuming untrusted WSDL.
Despite these issues arising from core .NET proxy behavior, Microsoft has classified these findings as application-layer problems and has opted to update documentation rather than make code changes.
For defenders, it is recommended to identify and secure any use of ServiceDescriptionImporter that processes attacker-controlled WSDL. Additionally, audit all usages of SoapHttpClientProtocol, DiscoveryClientProtocol, HttpPostClientProtocol, and HttpGetClientProtocol where the URL property may be influenced by user input. Given the prevalence of the .NET Framework in enterprise environments, similar vulnerabilities are likely to surface in other solutions.
Based on reporting by Cyber Security News.