Bug 1058582 – CVE-2014-1202 SoapUI: remote code execution when processing WSDL

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1058582 - (CVE-2014-1202) CVE-2014-1202 SoapUI: remote code execution when processing WSDL

Summary:	CVE-2014-1202 SoapUI: remote code execution when processing WSDL

Status:	CLOSED NOTABUG

Aliases:	CVE-2014-1202

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20140115,repo...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2014-01-28 00:34 EST by David Jorm
Modified:	2018-03-01 13:43 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-01-28 00:40:54 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description David Jorm 2014-01-28 00:34:26 EST

It was found that SoapUI would expand properties in WSDL files. A remote attacker, able to supply a WSDL file that would be processed by SoapUI, could supply arbitrary Groovy code in the property of a WSDL element. This property would be expanded, and the Groovy code executed, when the SoapUI client processed the WSDL.

Comment 1 David Jorm 2014-01-28 00:36:36 EST

External References:

http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html

Upstream patch commit:

https://github.com/SmartBear/soapui/commit/6373165649ad74257493c69dbc0569caa7e6b4a6

Comment 2 David Jorm 2014-01-28 00:40:54 EST

Statement:

Not affected. Red Hat JBoss SOA Platform 4.3 and 5.3 support the SOAPClient action, which will use the SoapUI library to make calls to external web services. However, these products use SoapUI 1.7.1, while the vulnerable property expansion feature was not introduced until SoapUI 2.5. Therefore no Red Hat products are affected by this flaw.

Note You need to log in before you can comment on or make changes to this bug.