The vulnerability is exploitable via two primary endpoints: the Web Deploy Agent Service ('/MSDEPLOYAGENTSERVICE') on port 80 using NTLM authentication, and the WMSvc service ('/msdeploy.axd') on port 8172 using Basic authentication. Public proof-of-concept code is available, significantly increasing the risk of exploitation. Defenders should verify the version of 'msdeploy.exe' on their IIS servers and prioritize patching to 10.0.2001 or higher.

Attack Chain

1. Attacker performs reconnaissance to identify IIS servers exposing the Web Deploy Agent Service (port 80) or WMSvc (port 8172).
2. Attacker obtains or identifies low-privilege credentials valid for the targeted service authentication (NTLM or Basic).
3. Attacker crafts a serialized .NET payload designed to trigger a TypeConfuseDelegate gadget chain.
4. Attacker sends an HTTP POST request to the target endpoint, inserting the malicious payload into the 'MSDeploy.SyncOptions' header.
5. The target application's 'BinaryFormatter.Deserialize()' method processes the header, instantiating the malicious object graph.
6. The gadget chain execution causes the application process to invoke 'Process.Start' to run arbitrary system commands (e.g., 'cmd.exe').
7. Attacker achieves remote code execution, typically resulting in the creation of persistence mechanisms or the execution of further payloads.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server, potentially leading to full system compromise. Given the service's role in deployment and administration, this can facilitate lateral movement, exfiltration of application data, or the deployment of ransomware. The vulnerability has a CVSS 8.8 score and is actively being targeted with public exploit code.

Recommendation

• Patch Microsoft Web Deploy to version 10.0.2001 or later immediately across all IIS environments.
• Disable the Web Deploy Agent Service and WMSvc if they are not strictly required for business operations.
• Apply the detection rules below to identify exploitation attempts targeting the 'MSDeploy.SyncOptions' header.
• Restrict network access to port 80/8172 endpoints via firewalls to only authorized management subnets.
• Monitor logs for unusual 'cmd.exe' or 'powershell.exe' process spawns originating from the 'msdeploy.exe' process or related IIS worker processes.