WSO2RCE

The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking, allowing arbitrary file upload and remote code execution.

Affected Products:

• WSO2 API Manager 2.2.0, up to 4.0.0
• WSO2 Identity Server 5.2.0, up to 5.11.0
• WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0
• WSO2 Identity Server as Key Manager 5.3.0, up to 5.11.0
• WSO2 Enterprise Integrator 6.2.0, up to 6.6.0
• WSO2 Open Banking AM 1.4.0, up to 2.0.0
• WSO2 Open Banking KM 1.4.0, up to 2.0.0

PoC

Warning: For educational purposes only.

Download the exploit

Clone this repository:

git clone https://github.com/Pasch0/WSO2RCE.git
cd WSO2RCE
pip install rich

Running the exploit

To start the attack, use the -u flag to specify a single target URL or -f for a file with multiple targets:

python run.py -u https://target.com/

Accessing the backdoor

When accessing the backdoor via the URL generated during script execution, you can interact with the text field by entering system commands and receiving the response on the page.

SOLUTION

WSO2 provided temporary mitigations to customers in January 2022 and provided fixes for all supported product versions listed on the WSO2 Support Matrix (status "available" and "obsolete") in February. If you are a WSO2 customer with a Support Subscription, use WSO2 Updates to apply the fix.

For more details visit: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738