feat: Detect SOAP/JAX-WS ThreadLocal Authentication Bypass

What?

Add detection for SOAP or JAX-WS ThreadLocal auth bypass

Why?

Currently there was no detection of that attack vector, an example payload

POST /ac-iasp-backend-jaxws/UserManager HTTP/1.1
Host: sandbox.coreruleset.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Connection: keep-alive
X-Format-Output: txt-matched-rules-extended
X-CRS-Paranoia-Level: 3
Content-Type: text/xml; charset=UTF-8
Content-Length: 341

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
                  xmlns:jax="http://jaxws.user.frontend.iasp.service.actividentity.com">
  <soapenv:Header/>
  <soapenv:Body>
    <jax:findUserIds>
      <arg0></arg0>
      <arg1>spl*</arg1>
    </jax:findUserIds>
  </soapenv:Body>
</soapenv:Envelope>

that how an attack looks like, just as a feedback if that possible to detect, without any issues

References

• https://hacktricks.wiki/en/pentesting-web/soap-jax-ws-threadlocal-auth-bypass.html#soapjax-ws-threadlocal-authentication-bypass

Start by reading the linked HackTricks reference and the SOAP/JAX-WS attack example in the issue. The payload does not identify a rule file, test, or entry point, so the detection location and validation steps still need to be established. Done means the described ThreadLocal authentication bypass is detected without causing the reported issues.