CVE-2022-29464: WSO2 Management - Arbitrary File Upload & Remote Code Execution

1. In CISA KEVCISA KEV catalogue25 Apr 2022
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 25 Apr 2022 · known ransomware use · catalogue entry

Public check

WSO2 Management - Arbitrary File Upload & Remote Code Execution · nuclei template in projectdiscovery/nuclei-templates

Weakness

Path Traversal · File and Path Handling

Vendor

WSO2

Published

April 2022

Band

Exploited in the wild, April 2022

1. 5 Nov
   CISA’s KEV entry now notes known ransomware use CISA
2. 25 Apr 2022
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• Weakness CWE-22cwe.mitre.org
• github.com/hakivvi/CVE-2022-29464github.com
• packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Rpacketstormsecurity.com
• security.docs.wso2.com/en/latest/security-announcements/securitysecurity.docs.wso2.com
• Mailing listopenwall.com