SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability

The impact of this RCE vulnerability is significant. An attacker can gain complete control over the affected system, potentially leading to data theft, system compromise, and further lateral movement within the network. The attacker could install malware, modify system configurations, or even pivot to other systems. Because user interaction is required, attackers would likely leverage social engineering techniques like phishing or malicious website hosting to deliver the exploit. The blast radius extends to any system running a vulnerable version of SoapUI and accessible to the targeted user.

Organizations that heavily rely on SMARTBEAR SoapUI for API testing and development are at significant risk. This includes teams involved in software development, quality assurance, and security testing. Environments where SoapUI is deployed on shared hosting platforms or with limited access controls are particularly vulnerable.

• windows / supply-chain: Monitor PowerShell execution for unusual commands related to file manipulation or code execution within the SoapUI installation directory. Use Windows Defender to scan for suspicious files or processes.

Get-Process -Name SoapUI | Select-Object -ExpandProperty Path

• linux / server: Monitor system logs (journalctl) for errors or warnings related to file access within the SoapUI installation directory. Use lsof to identify processes accessing files within that directory.

lsof /opt/soapui/bin/

• generic web: Check access and error logs for requests containing suspicious file paths or URL parameters that could be exploited for directory traversal. Examine response headers for unexpected content or error messages.

curl -I http://your-soapui-server/malicious_file.xml

1. 2024-11-22Disclosure

   disclosure

1. Reserviert2024-08-06
2. Veröffentlicht2024-11-22
3. Geändert2024-11-26
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-7565 is to upgrade to a patched version of SMARTBEAR SoapUI. Unfortunately, a fixed version is not yet available. As a temporary workaround, restrict access to SoapUI instances and implement strict user awareness training to prevent users from opening suspicious files or visiting untrusted websites. Consider implementing a Web Application Firewall (WAF) to filter potentially malicious requests targeting the unpackageAll function. Monitor system logs for unusual activity related to file operations and process execution. There are no specific Sigma or YARA rules available at this time.