CVE-2018-20580

published 2019-05-03

CVE-2018-20580: The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a…

Priority P2 66 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
smartbear	readyapi	—	—
smartbear	readyapi	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Malicious payload is embedded in the default value of a WSDL parameter; inspect WSDL files imported into ReadyAPI for unexpected Java/script content in parameter default values ↗
• → Trigger condition is a ReadyAPI user sending a request after loading a crafted WSDL; monitor ReadyAPI process for unexpected child process spawning or outbound connections following WSDL import ↗
• → Exploitation requires the victim to load a WSDL file via the SOAP project import feature in ReadyAPI 2.5.0 or 2.6.0; alert on WSDL imports from untrusted/external sources in these specific versions ↗

• · Vulnerability is confirmed only in ReadyAPI versions 2.5.0 and 2.6.0; other versions are not stated to be affected ↗
• · The exploit was tested on Windows; behaviour on other operating systems is not confirmed by the source ↗
• · The attack requires user interaction: the victim must both import the malicious WSDL and actively send a request before code execution occurs ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20