The Soap Effect Breaking Security Assumptions In Real World Systems

This talk addresses the ongoing relevance of SOAP in critical systems like billing and document processing. Adobe Senior Offensive Security Researcher Kamalpreet Khurana explores the zero-day XXE vulnerability he discovered in 2025, highlighting how the XML parsing layer in SOAP continues to pose security risks that are often overlooked by developers and security teams. The session delves into how WSDL files can inadvertently provide attackers with a roadmap of a SOAP service, and it outlines a five-stage XXE exploitation methodology that can lead to the extraction of sensitive data. Participants will also learn about practical defense-in-depth strategies for organizations that cannot transition to REST, including methods such as disabling external entities and network isolation.