Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

The remote web server is running a WSO2 product that is affected by a file upload remote command execution vulnerability due to improper validation of user input. A remote, unauthenticated attacker can leverage this by uploading a malicious jsp script to the web server resulting in remote command execution.

Note that Nessus tests for this vulnerability by sending a benign POST request to the vulnerable endpoint and analyzes the response to determine if the vulnerability is present or has been patched or mitigated.

Detections

Analytics

CVE-2022-29464

critical

Tenable Plugins

critical