I refer you to an unanswered post in February 2018 - https://our.umbraco.com/forum/using-umbraco-and-getting-started/90790-umbraco-webservice-folder-in-v74

We are experiencing a similar scenario. A recent penetration test of our website uncovered the following;

"The website was found to expose a SOAP interface externally that allows functionalities such as ‘SaveDLRScript’. This functionality is commonly used to perform unauthorised arbitrary file upload and to gain remote access. The following URL was identified on the primary website.

Vulnerable URL: https://www.oursite.com/umbraco/webservices/codeEditorSave.asmx?WSDL"

We are using the IPWhitelistModule.cs to prevent external IPs accessing the following;

            filePath.ToLower().Contains("umbraco")
            && !filePath.ToLower().Contains("umbraco/api")
            && !filePath.ToLower().Contains("umbraco/surface")
            && !filePath.ToLower().Contains("umbraco/plugins")
            && !filePath.ToLower().Contains("umbraco/webservices")
            && !filePath.ToLower().Contains("umbraco/webservices/api")
            && !filePath.ToLower().Contains("umbraco/backoffice")

I am therefore curious as to how external IPs can hit the "vulnerable " URL.

Same question as the Feb 2018 post - Can I delete the webservices folder? Is there anything depending on it by default?

Thanks!