

SECURITY ADVISORY WSO2-2023-2988

Published: May 31, 2024

Version: 1.0.0

Severity: High

CVSS Score: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

---

AFFECTED PRODUCTS

• WSO2 API Manager : 4.2.0, 4.1.0, 4.0.0, 3.2.0, 3.1.0

OVERVIEW

Unrestricted arbitrary file upload, and remote code to execution vulnerability.

DESCRIPTION

Due to improper validation of user input in “Add API Documentation” feature, a malicious actor with following permission could upload an arbitrary file to a user controlled location of the server. * /permission/admin/login * /permission/admin/manage/api/publish

By leveraging the arbitrary file upload vulnerability, it is further possible to gain remote code execution on the server.

IMPACT

By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

SOLUTION

If the latest version of the affected WSO2 product is not mentioned under the affected product list, you may migrate to the latest version to receive security fixes. Otherwise you may apply the relevant fixes to the product based on the public fix:

• https://github.com/wso2/carbon-apimgt/pull/12206/files

Info

If you are a WSO2 customer with Support Subscription, please use WSO2 Updates in order to apply the fix.

CREDITS

WSO2 thanks, Siebene@ for responsibly reporting the identified issue and working with us as we addressed it.