CVE-2012-5351¶

WSO2 Products impacted: no

Customer action required: no

REPORTED VULNERABILITY¶

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, also known as a "Signature exclusion attack".¹

REPORTED PRODUCTS¶

• WSO2 Identity Server : 7.2.0

WSO2 JUSTIFICATION¶

Apache Axis2 is used in WSO2 Identity Server as the core SOAP/Web Services engine, handling service deployment, message routing and transport management. The product ships a WSO2-maintained fork of Axis2 rather than the upstream 1.6.1 release.² In this product, the Axis2 layer serves purely as the service framework for SOAP-based admin services and internal component communication; it does not perform SAML assertion processing or XML Signature validation.

SAML assertion validation and XML Signature verification in WSO2 Identity Server are performed by the product's own identity framework, backed by OpenSAML and Apache Santuario.³ Signature validation is carried out through OpenSAML's SignatureValidator and ExplicitKeySignatureTrustEngine, with no involvement of the Axis2 engine.⁴⁵ The shipped Axis2 bundle contains no SAML or XML Signature processing classes.

The vulnerable code path described in this CVE is therefore not reachable in this product configuration.

Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.

REFERENCES¶