

Security Advisory WSO2-2016-0168

Published: November 08, 2016

---

OVERVIEW

WSO2 API Manager is vulnerable to unauthorized user access of swagger definition URL import API in API Publisher.

DESCRIPTION

WSO2 API Manager provides an API for swagger definition import by swagger resource URL. This particular API is vulnerable to unauthorized user access and it can be invoked by anonymous users. Thus an attacker who doesn't even have credentials to access API Publisher can possibly access the swagger definition URL import API.

In addition to that, the imported swagger content has not been validated by the API.

IMPACT

An attacker can invoke the swagger definition import API as an anonymous user and perform malicious activities. Further, the attacker can use an invalid URL or a URL with invalid swagger definition content, since it has not been validated during the swagger definition import time.

SOLUTION

Please use WSO2 Update Manager (WUM) to update the following products.

Code	Product	Version
AM	WSO2 API Manager	2.0.0

Info

If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed.