PT-2020-9297 · Smartbear · Soapui+1

Published 2020-02-05 · Updated 2020-08-24 · CVE-2019-12180

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SmartBear ReadyAPI versions 2.8.2 through 3.0.0 SoapUI version 5.5

Description An issue was discovered that allows an attacker to execute arbitrary Groovy Language code on the victim machine by inducing it to open a malicious project. This occurs because the Groovy "Load Script" is automatically executed when opening a project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project.

Recommendations For SmartBear ReadyAPI versions 2.8.2 through 3.0.0, consider disabling the Groovy "Load Script" and "Save Script" functions until a patch is available. For SoapUI version 5.5, consider disabling the Groovy "Load Script" and "Save Script" functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2019-12180

Affected Products

Smartbear Readyapi

Soapui

References · 10

• 🔥 https://github.com/0x-nope/CVE-2019-12180 · Exploit
• 🔥 https://lab.mediaservice.net/advisory/2020-04-readyapi-soapui.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12180 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12180 · Vendor Advisory
• https://t.me/defcon_news/37585 · Telegram Post
• https://t.me/rnetsec/11491 · Telegram Post
• https://t.me/canyoupwnme/6279 · Telegram Post
• https://t.me/malwr/2205 · Telegram Post
• https://t.me/cvenotify/792 · Telegram Post
• https://t.me/secharvester/8392 · Telegram Post