CVE-2022-29464
Description
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
Summary dbcve.org
Unrestricted file upload vulnerability in multiple WSO2 products allows remote code execution. An attacker can use the /fileupload endpoint with a Content-Disposition directory traversal sequence (e.g., ../../../../repository/deployment/server/webapps) to write a malicious file into a directory under the web root, which is then executed by the application server. No authentication is required, making this a pre-authentication RCE flaw across numerous WSO2 components.
Mitigation
Apply the official WSO2 security patches for the affected product/version, restrict access to the /fileupload endpoint (e.g., network-level controls or WAF rules blocking directory-traversal payloads), and audit the repository/deployment/server/webapps directory and web server logs for unexpected JSPs, WARs, or other artifacts that may have been dropped before patching.