CVE-2024-7565 Overview
CVE-2024-7565 is a directory traversal vulnerability in SmartBear SoapUI that allows remote attackers to execute arbitrary code on affected installations. The flaw resides in the unpackageAll function, which fails to properly validate a user-supplied path before performing file operations. Exploitation requires user interaction: the target must open a malicious file or visit a malicious page. Successful exploitation results in code execution in the context of the current user. The issue was originally tracked as ZDI-CAN-19060 and disclosed through the Zero Day Initiative.
Critical Impact
Attackers can write files to arbitrary locations on disk through path traversal in unpackageAll, leading to arbitrary code execution as the SoapUI user.
Affected Products
- SmartBear SoapUI 5.7.0
- SoapUI installations processing untrusted package files
- Workstations where SoapUI users open shared or downloaded project archives
Discovery Timeline
- 2024-11-22 - CVE-2024-7565 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7565
Vulnerability Analysis
The vulnerability is a path traversal issue [CWE-22] in the SoapUI unpackageAll routine. SoapUI supports packaging and unpackaging of project archives containing multiple files. During extraction, unpackageAll uses file names from the archive to construct output paths on disk. The function does not validate whether those names contain traversal sequences such as ../ before writing files. As a result, an archive can direct writes outside the intended destination directory.
An attacker crafts a malicious SoapUI package that contains entries with traversal sequences in their file names. When a user opens or imports the package, SoapUI writes attacker-controlled content to attacker-chosen locations, including startup directories, user configuration paths, or locations from which SoapUI or another application will later load code. This produces arbitrary code execution in the context of the user running SoapUI.
Root Cause
The root cause is missing canonicalization and validation of archive member paths inside unpackageAll. The function trusts the archive-supplied file name and joins it directly with the target extraction directory. It does not verify that the resolved absolute path stays within that directory.
Attack Vector
The attack vector is local and requires user interaction. An attacker distributes a malicious SoapUI project archive through email, chat, a shared repository, or a web download. When the user opens the archive in SoapUI, the vulnerable extraction logic writes files to attacker-chosen locations. See the Zero Day Initiative Advisory ZDI-24-1100 for the vendor-coordinated disclosure details.
No verified public proof-of-concept code is available. The technical mechanism follows the standard Zip Slip pattern applied to SoapUI's package format.
Detection Methods for CVE-2024-7565
Indicators of Compromise
- SoapUI package files (typically .zip or SoapUI project archives) that contain entries with ../ or absolute path prefixes in their file names.
- Unexpected files written outside the SoapUI workspace directory shortly after a project import.
- New or modified files in user startup locations, browser extension directories, or application auto-load paths correlated with SoapUI activity.
Detection Strategies
- Inspect SoapUI project archives before opening by listing their contents and rejecting archives whose member paths escape the extraction root.
- Monitor process telemetry for SoapUI (soapui.exe or soapui.sh) writing files outside its installation and project directories.
- Alert on child processes spawned by SoapUI that are inconsistent with normal test execution, such as shells, scripting hosts, or LOLBins.
Monitoring Recommendations
- Log file-write events from the SoapUI process and forward them to a central SIEM for correlation with archive imports.
- Track SoapUI version inventory across developer and QA workstations to identify systems still on 5.7.0 or earlier.
- Watch for SoapUI reading archives from user download directories immediately followed by writes to sensitive paths.
How to Mitigate CVE-2024-7565
Immediate Actions Required
- Upgrade SoapUI to the latest release that addresses unpackageAll path traversal. Consult the SoapUI release notes for the fixed version.
- Instruct users not to open SoapUI project archives received from untrusted sources or from unexpected senders.
- Inventory all SoapUI installations, prioritizing systems that handle third-party or externally sourced projects.
Patch Information
SmartBear addressed the flaw in a subsequent SoapUI release following coordinated disclosure with the Zero Day Initiative. Apply the fixed version referenced in the SoapUI release notes and the ZDI-24-1100 advisory.
Workarounds
- Restrict SoapUI usage to project archives created internally and stored in trusted repositories with integrity controls.
- Run SoapUI under a low-privilege user account to limit the impact of file writes to sensitive system locations.
- Extract untrusted archives in an isolated sandbox or virtual machine and manually inspect member paths before importing them into SoapUI.
# Inspect a SoapUI project archive for traversal sequences before opening
unzip -l suspicious-project.zip | awk '{print $4}' | grep -E '(^/|\.\./)'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
