CVE-2012-4418¶

WSO2 Products impacted: no

Customer action required: no

REPORTED VULNERABILITY¶

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack".¹

REPORTED PRODUCTS¶

• WSO2 Identity Server : 7.2.0

WSO2 JUSTIFICATION¶

Apache Axis2 is used in WSO2 Identity Server as the core SOAP/Web Services engine, handling service deployment, message routing and transport management. The product ships a WSO2-maintained fork of Axis2 rather than the upstream 1.6.1 release.² The Axis2 layer serves as the service framework for SOAP-based admin services and internal component communication; it does not perform SAML assertion processing or XML Signature validation.

SAML assertion validation and XML Signature verification are performed by the product's own identity framework, backed by OpenSAML and Apache Santuario.³ Signature validation is carried out through OpenSAML's SignatureValidator and ExplicitKeySignatureTrustEngine, with no involvement of the Axis2 engine.⁴⁵ The shipped Axis2 bundle contains no SAML or XML Signature processing classes, so the XML Signature wrapping path described in this CVE cannot be reached.

Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.

REFERENCES¶