ActivID administrator account takeover the story behind HID-...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.synacktiv.com/publications/activid-administrator-account-takeover-the-story-behind-hid-psa-2025-002.html
• Blog Title: ActivID administrator account takeover: the story behind HID-PSA-2025-002
• Suggested Section: Pentesting Web -> Web Vulnerabilities Methodology (new subsection like 'SOAP/JAX-WS Authentication Bypasses via ThreadLocal Context Reuse') and cross-linked from 'Network Services Pentesting -> 80,443 - Pentesting Web Methodology' as a Java EE/SOAP case study

🎯 Content Summary

This article describes an unauthenticated administrator account takeover in HID ActivID Appliance 8.5, tracked as HID‑PSA‑2025‑002. The bug is an authentication bypass in the internal SOAP JAX‑WS API exposed behind nginx and Oracle WebLogic. The post is very methodical: it first reconstructs the full web and Java architecture (nginx → WebLogic → EAR/WAR/EJB) and then drills into how JAX‑WS authentication is supposed to work, before showing how a flawed ThreadLocal session model allows attacke...

🔧 Technical Details

1. Abusing ThreadLocal-based authentication context in JAX‑WS handlers
The main trick is to exploit designs where per‑request authentication state is stored in a static ThreadLocal<Subject> (or similar) and not cleared between requests. A JAX‑WS SOAPHandler that only updates this Subject when a custom auth header (e.g., mySubjectHeader) is present, and silently does nothing if the header is missing, enables authentication bypass. Because application servers use thread pools, a worker thread may carry a previously authenticated admin Subject. By sending unauthenticated SOAP requests without the auth header, and ensuring they do not cause exceptions in the handler, an attacker can eventually land on that thread and have their request executed under the stale admin Subject. In any environment, if you see a ThreadLocal security context used this way, test by removing the auth header and repeatedly calling pri...

🤖 Agent Actions

Summary:

• Added a new “SOAP/JAX-WS Authentication Bypasses (ThreadLocal Context Reuse)” subsection to the Web Vulnerabilities Methodology checklist, detailing how to enumerate hidden SOAP endpoints, inspect handler chains, and exploit ThreadLocal subject leakage for unauthenticated administrator actions, plus mitigation guidance.
• Included practical reconnaissance and attack workflows, sample SOAP payloads, tool references (e.g., Wsdler), and defensive recommendations aligned with the Synacktiv research.
• Appended a References section with the Synacktiv article and Wsdler documentation to properly cite the new content.

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.synacktiv.com/publications/activid-administrator-account-takeover-the-story-behind-hid-psa-2025-002.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Web Vulnerabilities Methodology (new subsection like 'SOAP/JAX-WS Authentication Bypasses via ThreadLocal Context Reuse') and cross-linked from 'Network Services Pentesting -> 80,443 - Pentesting Web Methodology' as a Java EE/SOAP case study".

Repository Maintenance:

• MD Files Formatting: 916 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0