.NET SOAPwn Flaw Opens Door for File Writes and Remote Code Execution via Rogue WSDL

New research described by WatchTowr Labs, presented on 10 December 2025, details a .NET Framework flaw named SOAPwn that can enable remote code execution via rogue WSDL imports and HTTP client proxies. According to WatchTowr Labs, the vulnerability allows arbitrary file writes and code execution by manipulating file system handlers with a crafted file URL in a SOAP proxy, potentially enabling an attacker to target applications built on .NET and even overwrite existing files.

In a hypothetical attack, an attacker could use a UNC path and SMB shares to capture NTLM challenges, with exploitation vectors centred on WSDL-generated HTTP client proxies and the ServiceDescriptionImporter class that does not validate the URL used by proxies. The issue has been addressed in Barracuda Service Center RMM version 2025.1.1 (CVE-2025-34392, CVSS 9.8) and Ivanti EPM version 2024 SU4 SR1 (CVE-2025-13659, CVSS 8.8).

Microsoft has opted not to fix the vulnerability, noting it stems from application behaviour and that users should not consume untrusted input that can generate and run code.