A Playbook for Integration Servers

Introduction to Web Methods Integration Servers

Ryan Ro and Kumali (Carl) presented a playbook for identifying and exploiting vulnerabilities in Web Methods integration servers. These servers act as middleware, connecting older systems with newer applications and facilitating data transformation for business-to-business transactions. Major corporations like Aflac, Google, and AT&T utilize this technology, making it a critical component in sectors such as banking, healthcare, and insurance. The presenters highlighted that despite its widespread use, many security professionals lack detailed knowledge of these systems due to historically high training costs and fragmented documentation.

Understanding Web Methods

Web Methods was initially developed in 1996, acquired by Software AG in 2007, and most recently by IBM in 2024. Accessing comprehensive documentation was challenging and expensive, with training courses costing thousands of dollars. The documentation itself is extensive, estimated at around 30,000 pages, and was not always centralized, making it difficult for researchers to gain a thorough understanding.

Reconnaissance Techniques

The presenters outlined a multi-faceted approach to reconnaissance:

Shodan: Utilizing queries like www authenticate to identify integration servers, yielding hundreds of results.

Censys: Offering broader port scanning and integration with vulnerability databases, with good coverage in Asian markets and strong rule-based fingerprinting.

ZoomEye: Similar to Censys, with a wider port scanning range and robust integration with vulnerability databases.

Google: Employing simple searches to uncover companies using Web Methods, correlating with job postings and other data sources to identify approximately 2,800 companies.

Gungnir: A tool recommended for continuous scanning to discover hidden infrastructure and assets.

Exploitation Playbook

The core of their playbook involves:

Data Aggregation: Combining information from various reconnaissance sources.

Tooling: Using a custom-built tool (described as "terribly vibe coded") to process lists of IPs and domains.

Initial Testing: Running basic tests to confirm the presence of an integration server.

Default Credentials: Testing for and often finding default credentials, which yielded numerous vulnerabilities.

API Endpoint Testing: Interacting with approximately 5,100 documented API endpoints. Many of these can be accessed without authentication, allowing for actions like listing keys or potentially executing sensitive functions.

Vulnerability Discovery and Exploitation

Common vulnerabilities arise from developers mistakenly changing service permissions to default to overcome issues, inadvertently granting anonymous access. This can expose sensitive functionalities within packages like "VM public," which are intended for backward compatibility.

Vulnerable Services: When testing API endpoints, responses like 404 (not found), 401 (access denied), 500 (internal server error, indicating potential vulnerability requiring parameter discovery), or 200 (successful execution) indicate the status of a service.

Exploitable Endpoints: The presenters found that services like invoke followed by the service name could be executed as simple GET requests. They noted that many exposed services could lead to critical bounties, especially if they revealed sensitive data like B2B passwords.

Specific Vulnerable Services: Examples include services for HTML decoding (useful for XSS attacks) and OS command execution. While some services might require server-side configuration or have limitations on arguments, they often expose sensitive information or allow for command injection.

Custom Services: Companies that develop their own services using Web Methods can also introduce vulnerabilities if they follow predictable naming conventions and fail to secure them properly.

Key Takeaways and Future Outlook

The presenters emphasized that their methodology can be applied to other legacy integration servers. They successfully submitted around 80 bug reports and VDPs, but believe a larger team could uncover significantly more vulnerabilities. They encourage new bug bounty hunters to use their tools and techniques to find and report their first bug. Their future plans include investigating other integration platforms like MuleSoft. They concluded by stating that many legacy systems remain exposed on the internet, offering opportunities for security research.