CAPEC-95 Metadata
Likelihood of Attack
High
Typical Severity
High
Overview
Summary
This attack targets the WSDL interface made available by a web service. The attacker may scan the WSDL interface to reveal sensitive information about invocation patterns, underlying technology implementations and associated vulnerabilities. This type of probing is carried out to perform more serious attacks (e.g. parameter tampering, malicious content injection, command injection, etc.). WSDL files provide detailed information about the services ports and bindings available to consumers. For instance, the attacker can submit special characters or malicious content to the Web service and can cause a denial of service condition or illegal access to database records. In addition, the attacker may try to guess other private methods by using the information provided in the WSDL files.
Prerequisites
A client program connecting to a web service can read the WSDL to determine what functions are available on the server. The target host exposes vulnerable functions within its WSDL interface.
Execution Flow
| Step | Phase | Description | Techniques |
|---|---|---|---|
| 1 | Explore | [Scan for WSDL Documents] The adversary scans for WSDL documents. The WDSL document written in XML is like a handbook on how to communicate with the web services provided by the target host. It provides an open view of the application (function details, purpose, functional break down, entry points, message types, etc.). This is very useful information for the adversary. |
|
| 2 | Experiment | [Analyze WSDL files] An adversary will analyze the WSDL files and try to find potential weaknesses by sending messages matching the pattern described in the WSDL file. The adversary could run through all of the operations with different message request patterns until a breach is identified. |
|
| 3 | Exploit | [Craft malicious content] Once an adversary finds a potential weakness, they can craft malicious content to be sent to the system. For instance the adversary may try to submit special characters and observe how the system reacts to an invalid request. The message sent by the adversary may not be XML validated and cause unexpected behavior. |
|
Potential Solutions / Mitigations
It is important to protect WSDL file or provide limited access to it. Review the functions exposed by the WSDL interface (especially if you have used a tool to generate it). Make sure that none of them is vulnerable to injection. Ensure the WSDL does not expose functions and APIs that were not intended to be exposed. Pay attention to the function naming convention (within the WSDL interface). Easy to guess function name may be an entry point for attack. Validate the received messages against the WSDL Schema. Incomplete solution.
Related Weaknesses (CWE)
| CWE ID | Description |
|---|---|
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory |
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-54 | An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide. |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.