CVE-2020-13578 – A denial-of-service vulnerability in Genivia gS... (How to Fix)

Q: What is the severity of CVE-2020-13578?

CVE-2020-13578 has a CVSS score of 7.5 (HIGH). A denial-of-service vulnerability in Genivia gSOAP's WS-Security plugin allows attackers to crash affected services by sending specially crafted SOAP requests. This affects systems using gSOAP 2.8.107 with WS-Security enabled. The vulnerability can be exploited remotely via HTTP requests.

📋 TL;DR

A denial-of-service vulnerability in Genivia gSOAP's WS-Security plugin allows attackers to crash affected services by sending specially crafted SOAP requests. This affects systems using gSOAP 2.8.107 with WS-Security enabled. The vulnerability can be exploited remotely via HTTP requests.

💻 Affected Systems

Products:

Genivia gSOAP

Versions: Version 2.8.107

Operating Systems: Linux, Windows, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with WS-Security plugin enabled. The vulnerability is in the WS-Security functionality specifically.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service outage of affected SOAP web services, potentially affecting critical business functions that rely on these services.

🟠

Likely Case

Temporary service disruption requiring service restart, leading to downtime and potential data loss for in-flight transactions.

🟢

If Mitigated

Minimal impact with proper network segmentation and monitoring allowing quick detection and response to attack attempts.

🌐 Internet-Facing: HIGH - Attackers can exploit this remotely without authentication via HTTP requests to vulnerable endpoints.

🏢 Internal Only: MEDIUM - Internal attackers or compromised systems could exploit this to disrupt internal services.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending a specially crafted SOAP request to vulnerable endpoints. The Talos Intelligence report includes technical details that could be used to create exploits.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: gSOAP 2.8.108 or later

Vendor Advisory: https://www.genivia.com/advisory.html

Restart Required: Yes

Instructions:

1. Download latest gSOAP version from Genivia website. 2. Replace vulnerable gSOAP library. 3. Recompile affected applications. 4. Restart services using gSOAP.

🔧 Temporary Workarounds

Disable WS-Security

all

Temporarily disable WS-Security plugin if not required for functionality

Modify application configuration to disable WS-Security plugin

Network Filtering

all

Implement WAF rules to block malicious SOAP requests

Add WAF rule to detect and block malformed SOAP requests with WS-Security headers

🧯 If You Can't Patch

Implement strict network segmentation to limit access to vulnerable services
Deploy rate limiting and request validation at the network perimeter

🔍 How to Verify

Check if Vulnerable:

Check gSOAP version and verify WS-Security plugin is enabled in application configuration

Check Version:

gsoap --version 2>/dev/null || check application documentation for version information

Verify Fix Applied:

Verify gSOAP version is 2.8.108 or later and test SOAP requests with WS-Security do not cause service crashes

📡 Detection & Monitoring

Log Indicators:

Service crashes or restarts
Error logs mentioning WS-Security or SOAP parsing failures
Unusual HTTP 500 responses from SOAP endpoints

Network Indicators:

Spike in malformed SOAP requests
Requests with unusual WS-Security headers
HTTP requests causing service termination

SIEM Query:

source="webserver" AND (status=500 OR message="crash" OR message="segfault") AND uri="*.wsdl"

📊 Metadata

CVE ID: CVE-2020-13578

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: February 10, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-13578, you might also want to check these: