CVE-2025-13428: Google Security Operations Soar RCE Flaw

CVE-2025-13428 Overview

CVE-2025-13428 is a Remote Code Execution (RCE) vulnerability in the Google Security Operations SOAR server. The flaw resides in the custom integrations feature, which allowed authenticated users assigned an IDE role to upload malicious Python packages. The server failed to validate uploaded package code adequately, permitting attacker-controlled setup.py files to execute during installation. Successful exploitation results in arbitrary code execution within the SOAR server context. Google has remediated the issue by automatically upgrading all customers to version 6.3.64 or higher. No customer action is required. The vulnerability is tracked under [CWE-20: Improper Input Validation].

Critical Impact
An authenticated user with IDE role privileges can achieve Remote Code Execution on the SecOps SOAR server through a crafted Python package upload, leading to full server compromise.

Affected Products

Google Security Operations SOAR versions prior to 6.3.64
Google SecOps SOAR custom integrations feature (Python package upload component)
Deployments accessible to users holding the IDE role permission

Discovery Timeline

2025-12-09 - CVE-2025-13428 published to NVD
2025-12-09 - Google Cloud Security Bulletin gcp-2025-075 released
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-13428

Vulnerability Analysis

The vulnerability exists in the custom integrations workflow of Google SecOps SOAR. Administrators and developers use this feature to extend platform functionality through Python packages. The server accepts uploaded packages and installs them using a standard Python package installation process. During installation, Python executes the package's setup.py script to perform build and configuration tasks.

The SOAR server did not enforce strict validation on the contents of uploaded Python packages. An authenticated user assigned the IDE role could craft a package containing arbitrary Python code inside setup.py. When the server installed the package, the malicious code executed in the server process context. This grants the attacker the same privileges as the SOAR installation, enabling data exfiltration, lateral movement, or persistence within the security operations platform.

Root Cause

The root cause is insufficient input validation [CWE-20] of uploaded Python package code. The system relied on package installation routines that execute setup scripts by design. Without sandboxing, content inspection, or static analysis of uploaded archives, any executable payload embedded in setup.py ran with server privileges.

Attack Vector

Exploitation requires network access to the SOAR server and authenticated credentials holding the IDE role. The attacker authenticates, navigates to the custom integrations feature, and uploads a malicious Python package. The server processes the package and executes the attacker's code. The attack vector is network-based with high privilege requirements and no user interaction. See the Google Cloud Security Bulletin for vendor details.

Detection Methods for CVE-2025-13428

Indicators of Compromise

Unexpected custom integration package uploads from accounts holding the IDE role, especially outside normal change windows.
New or modified setup.py files in custom integration packages containing system calls, subprocess invocations, or network sockets.
Outbound network connections originating from the SOAR server process to unfamiliar hosts following an integration upload.
Creation of unexpected child processes spawned by the SOAR Python installer.

Detection Strategies

Audit SOAR server logs for custom integration upload events and correlate against authorized change requests.
Inspect Python package archives in transit or at rest for embedded shell commands, encoded payloads, or unexpected imports in setup.py.
Monitor process trees on the SOAR server for non-standard children of the Python interpreter during package installation.
Compare deployed SOAR build versions against the fixed release 6.3.64 to confirm patch status.

Monitoring Recommendations

Continuously track which accounts hold the IDE role and alert on new grants or role assignments.
Forward SOAR application logs, host process telemetry, and network flows to a central analytics platform for correlation.
Establish a baseline of legitimate custom integration activity and alert on deviations such as unusual upload frequency or large archive sizes.

How to Mitigate CVE-2025-13428

Immediate Actions Required

Confirm the SOAR server runs version 6.3.64 or later. Google has automatically upgraded all customer instances.
Review the list of accounts currently assigned the IDE role and revoke privileges that are not strictly required.
Audit recent custom integration uploads and remove any packages from untrusted or anomalous sources.
Rotate credentials and API tokens associated with the SOAR server if unauthorized integration activity is identified.

Patch Information

Google released the fix in Google Security Operations SOAR version 6.3.64. According to the Google Cloud Security Bulletin, all customers have been automatically upgraded to the fixed version or higher. No customer action is required to apply the patch. Verify the deployed version through the SOAR administration interface.

Workarounds

Restrict the IDE role to a small set of vetted administrators until patch verification is complete.
Implement code review and approval workflows for custom integration packages before upload.
Isolate the SOAR server at the network layer to limit outbound connectivity from the installation process.
Enable detailed audit logging for the custom integrations feature and retain logs for forensic analysis.

bash

# Verify SOAR version meets or exceeds the fixed release
# Replace <soar-host> with your SOAR server hostname
curl -sk https://<soar-host>/api/version | grep -E '"version"\s*:\s*"6\.(3\.(6[4-9]|[7-9][0-9])|[4-9])'