CWE-651 is an information exposure in web services. A Web Service Definition Language (WSDL) file describes the services a caller can use, what parameters they expect and what types they return. Publishing it is often required, but the file can say more than you intended. SOAP and other XML web service deployments are the ones affected.
How it happens
MITRE gives the conditions. The WSDL is accessible to a wider audience than intended. Or it lists methods that should not be public, or deprecated methods. The risk grows because WSDL files are often generated automatically from code, so anything exposed in the code can end up in the file. Method names also help a reader guess the names and locations of resources that should stay private.
What an attacker gains
The consequence in the record is confidentiality: the attacker may find sensitive information in the WSDL, such as the list of operations and how to call them. It is reconnaissance that makes later attacks cheaper.
How to find it
The record lists no detection methods. A simple check is to request your own service URL with a ?wsdl suffix, or your usual WSDL path, from outside your network and read what comes back. Look for internal methods, test operations, deprecated calls and names that hint at private resources.
How to fix it
MITRE's mitigations:
- Limit access to the WSDL as much as possible. If the service is offered to a few entities, give them the WSDL privately instead of publishing it.
- Make sure the WSDL does not describe methods that should not be publicly accessible, and protect those methods with access controls anyway.
- Avoid method names in the WSDL that help an adversary guess private method or resource names.
Quick check
Is hiding the WSDL enough to protect a private method?
No. Protect the method itself with access controls. The WSDL change only reduces what an outsider can learn.
