Authenticated arbitrary file upload via a System REST API requiring administrator permission.
Impact
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.
Source excerpt · WSO2What to do
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
WSO2 · WSO2 API Manager
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 to before 4.2.0 | unaffected |
| 4.2.0 to before 4.2.0.179 | affected |
| 4.3.0 to before 4.3.0.91 | affected |
| 4.4.0 to before 4.4.0.55 | affected |
| 4.5.0 to before 4.5.0.38 | affected |
| 4.6.0 to before 4.6.0.3 | affected |
WSO2 · WSO2 API Control Plane
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 to before 4.5.0 | unknown |
| 4.5.0 to before 4.5.0.39 | affected |
| 4.6.0 to before 4.6.0.3 | affected |
WSO2 · WSO2 Universal Gateway
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 to before 4.5.0 | unknown |
| 4.5.0 to before 4.5.0.37 | affected |
| 4.6.0 to before 4.6.0.3 | affected |
WSO2 · WSO2 Traffic Manager
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 to before 4.5.0 | unknown |
| 4.5.0 to before 4.5.0.37 | affected |
| 4.6.0 to before 4.6.0.3 | affected |
WSO2 · org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl
Other versions: unknown
| Version / range | Source status |
|---|---|
| 9.28.116 to before 9.28.116.391 | affected |
| 9.29.120 to before 9.29.120.210 | affected |
| 9.30.67 to before 9.30.67.133 | affected |
| 9.31.86 to before 9.31.86.100 | affected |
| 9.32.147 to before 9.32.147.2 | affected |
| 9.32.167 through * (inclusive) | unaffected |
Original source description
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.
By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.