New .NET Framework Exploitation Primitive Enables Arbitrary File Writes and RCE via SOAP HTTP Client Proxies

The video presents a security research talk by Piotr Bazydło, a principal vulnerability researcher at Watch Towel, detailing a new exploitation primitive in .NET Framework involving SOAP HTTP client proxies and WSDL imports. The vulnerability allows attackers to manipulate URLs passed to .NET’s WebRequest.Create method, enabling protocol switching from HTTP to file protocols, resulting in arbitrary file writes or NTLM relaying, with potential escalation to remote code execution (RCE). The attack surface was identified in 2024 during SharePoint reviews but gained broader relevance in July 2025 when Bazydło discovered unauthenticated WSDL import functionality in Barracuda Service Center, which dynamically generates and compiles SOAP client proxies from attacker-controlled WSDLs. Exploitation requires control over the WSDL’s service URL, SOAP method names, or input arguments, with successful RCE demonstrated in products like Barracuda, Ivanti Endpoint Manager, Umbraco 8, Microsoft PowerShell, and SQL Server Integration Services. Microsoft declined to patch the root issue, citing intended behavior, but vendors like Ivanti addressed specific instances (CVE-8.8). The research highlights risks in applications using ServiceDescriptionImporter or unvalidated WSDL inputs, with mitigation requiring protocol validation before proxy invocation.