Unisys WebPerfect Image Suite WCF SOAP Endpoint NTLMv2 Hash Leakage Vulnerability

A vulnerability exists in Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604, where an unauthenticated WCF SOAP endpoint on TCP port 1208 exposes the ReadLicense action's LFName parameter to unsanitized file paths. This flaw allows remote attackers to initiate SMB connections that leak NTLMv2 machine-account hashes. By crafting SOAP requests with UNC paths, attackers can force the server to make outbound SMB connections, revealing authentication credentials that could be relayed for privilege escalation or lateral movement within the network.

Impact

Exploitation of this vulnerability leads to the unauthorized leakage of NTLMv2 machine-account hashes, which can be used to impersonate machine accounts or escalate privileges within the network.