A Critical Unauth RCE through arbitrary file upload was found in management console of following WSO2 products by @orange_8361
π΄ API Manager
π΄ Identity Server
π΄ Enterprise Integrator
π΄ API Manager
π΄ Identity Server
π΄ Enterprise Integrator
The vulnerability has CVSSv3 9.8 score assigned with CVE-2022-29464 & WSO2 Security Advisory WSO2-2021-1738
WSO2 has released security updates and mitigation guides docs.wso2.com/display/Securiβ¦
Security researcher @hakivvi has published an excellent write-up of PoC of exploitation & the root cause of the flaw at github.com/hakivvi/CVE-20β¦
In general, WSO2 management console which is running on port 9443 is not open to the public internet. However @shodanhq shows 1,479 results of such installation on port 9443. shodan.io/search?query=Wβ¦
IMO, this issue should be addressed ASAP due to WSO2 products works as backbones of enterprise data/message flows.
β’ β’ β’
Missing some Tweet in this thread? You can try to
force a refresh
γ
