CVE-2017-8759
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."
Analysis
Microsoft .NET Framework allows remote code execution through a malicious document or application that exploits SOAP WSDL parsing to inject and execute arbitrary code, used by the FinFisher/FinSpy surveillance platform.
Technical Context
The CWE-94 code injection occurs when the .NET Framework processes a SOAP WSDL definition containing specially crafted content. The WSDL parser generates and compiles C# code from the WSDL, and by injecting malicious code into the WSDL structure, an attacker achieves arbitrary code execution during compilation.
Affected Products
['Microsoft .NET Framework 2.0', 'Microsoft .NET Framework 3.5', 'Microsoft .NET Framework 3.5.1', 'Microsoft .NET Framework 4.5.2 through 4.7']
Remediation
Apply Microsoft security update. This vulnerability demonstrates the risk of code-generation-based SOAP processing. Restrict .NET applications from processing untrusted WSDL definitions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today