Description
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE).
This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 Identity Server | 5.10.0 – < 5.10.0.360, 5.11.0 – < 5.11.0.399, 6.0.0 – < 6.0.0.235, 6.1.0 – < 6.1.0.230, 7.0.0 – < 7.0.0.101, 7.1.0 – < 7.1.0.32 | 5.10.0.360 |
| WSO2 | WSO2 Enterprise Integrator | 6.6.0 – < 6.6.0.217 | 6.6.0.217 |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – < 2.0.0.402 | 2.0.0.402 |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 – < 5.10.0.353 | 5.10.0.353 |
| WSO2 | WSO2 API Manager | 3.2.0 – < 3.2.0.421, 3.2.1 – < 3.2.1.41, 4.0.0 – < 4.0.0.342, 4.1.0 – < 4.1.0.203, 4.2.0 – < 4.2.0.142, 4.3.0 – < 4.3.0.55, 4.4.0 – < 4.4.0.19, 4.5.0 – < 4.5.0.2, 4.6.0 – < 4.6.0.3 | 3.2.0.421 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.2, 4.6.0 – < 4.6.0.3 | 4.5.0.2 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.2, 4.6.0 – < 4.6.0.3 | 4.5.0.2 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.2, 4.6.0 – < 4.6.0.3 | 4.5.0.2 |
| WSO2 | org.wso2.carbon.commons:org.wso2.carbon.application.upload | 4.7.19 – < 4.7.19.7, 4.7.32 – < 4.7.32.5, 4.7.35 – < 4.7.35.8, 4.7.39 – < 4.7.39.1, 4.7.49 – < 4.7.49.4, 4.7.52 – < 4.7.52.1, 4.10.13 – < 4.10.13.1 | 4.7.19.7 |