U.S. Dept Of Defense · Report #390359
SOAP WSDL Parser SQL Code Execution
Summary
A critical SOAP WSDL Parser SQL Code Execution vulnerability (assigned CVE-2018-16803) was discovered on a Department of Defense (DoD) website by Joel Aviad Ossi. If properly exploited this could have resulted in the complete loss of the website and the underlining information system. Researcher websecnl was able to expertly demonstrate this vulnerability to the DoD's Vulnerability Disclosure Program (VDP), and it was rapidly mitigated by the system owner. Very well done websecnl, thank you!
DoD VDP Team
How it was found
Summary: SOAP WSDL Parser SQL Code Execution
Description: It was possible to parse WSDL resources and read all functions from the SOAP Admin Panel, therefor i was able to repeat the sql query with a tampered request with my own custom SQL command. i was able to extract all the database names for PoC, there is no doubt in my mind that i could login to the admin panel and compromise the entire DoD Information System.
Impact
Remote Code Execution
Step-by-step Reproduction Instructions
- Visit:███ and go to the staff links 'CIMScan' Image: █████/34570b2eaa899ae001e1bc666be3546a.png
- ████/c400bc1369bddeca580646b14c38a562.png
- ████/32e085f593bfbf8599359d968cf52dc0.png
Product, Version, and Configuration (If applicable)
Web Application
Suggested Mitigation/Remediation Actions
I will report it to CIMScan since i am not sure if this affect's your code, it might very well be the code of CIMScan which in that case you will need to remove it from your website to prevent employees from being compromised.
Impact
Remote Code Execution