CoreWCF WS-Security Signature Verification Bypass

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation to .NET Core. Before versions 1.8.1 and 1.9.1, the WS-Security implementation in CoreWCF did not properly verify that the selected digital signature (ds:Signature) covered the expected Security header target. This flaw allows an attacker who has captured a signed SOAP message to replay arbitrary service operations as if they were the legitimate user.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to replay signed SOAP messages, effectively impersonating a legitimate user and performing unauthorized operations on the affected service. This can lead to unauthorized access, data manipulation, or other malicious actions performed under the victim's identity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in CoreWCF's WS-Security signature verification allows attackers to replay captured signed SOAP messages, impersonating victims and invoking arbitrary operations without additional privileges. This leads to a compromise of confidentiality and integrity of communications.

Such a security flaw can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and strong authentication mechanisms to prevent unauthorized access and data breaches.

Because the vulnerability enables authentication bypass and replay attacks, it undermines data authenticity and confidentiality guarantees that are critical for regulatory compliance.

Mitigation requires ensuring communication is protected by SSL/TLS to prevent interception of signed SOAP envelopes, which is essential to maintain compliance with security requirements in these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves replay attacks using captured signed SOAP envelopes in CoreWCF WS-Security. Detection involves monitoring network traffic for repeated signed SOAP messages that could indicate replay attempts.

Since the attack replays valid signed SOAP envelopes, traditional replay detection mechanisms like timestamp checks may fail because attackers can use fresh timestamps in the wsse:Security header.

To detect potential exploitation, you can capture and analyze SOAP messages on your network, looking for repeated or suspiciously similar signed SOAP envelopes from the same principal.

Suggested commands include using network packet capture tools such as tcpdump or Wireshark to filter and inspect SOAP traffic over HTTP/SOAP endpoints.

• Use tcpdump to capture SOAP traffic on the relevant port (e.g., 80 or 443): tcpdump -i <interface> -w capture.pcap port 80 or port 443
• Use tshark or Wireshark to filter and analyze captured packets for repeated SOAP envelopes with signed wsse:Security headers.
• Extract and compare the ds:Signature elements and wsse:Security timestamps in SOAP messages to identify replayed messages.

Because the vulnerability is in signature verification logic, detection on the system side may also involve enabling detailed logging in CoreWCF to record signature validation failures or anomalies, if such logging is available.

Useful 0 Not Useful 0