CVE-2022-29464
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 100%
from disclosure to weapon2 days
Published on NVDApr 18
1st PoC+2d
metasploitApr 1
CISA KEV+7d
Action required by CISAfederal deadline: 2022-05-16
Apply updates per vendor instructions.
In short
A flaw in WSO2 products allows attackers to upload files without proper restrictions to sensitive directories, enabling them to execute arbitrary code on the server. An attacker exploits a file upload endpoint by using path traversal tricks to bypass security checks.
Technical detail
The vulnerability exists in the /fileupload endpoint where insufficient validation of the Content-Disposition header allows directory traversal (CWE-22). An unauthenticated attacker can craft a request with traversal sequences (e.g., ../../../../repository/deployment/server/webapps) to write files to the web root, achieving remote code execution. Affected versions span multiple WSO2 products including API Manager, Identity Server, Enterprise Integrator, and Open Banking components.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Affected products
n/a · n/apublic PoCs found — 66
githubgithub.com/hakivvi/CVE-2022-29464★ 377githubgithub.com/0xdsm/WSOB★ 28githubgithub.com/SystemVll/CVE-2022-29464★ 11githubgithub.com/Ap0dexMe0/CVE-2022-29464★ 9githubgithub.com/gbrsh/CVE-2022-29464★ 7githubgithub.com/Chocapikk/CVE-2022-29464★ 5githubgithub.com/jimidk/Better-CVE-2022-29464★ 5githubgithub.com/hev0x/CVE-2022-29464★ 5githubgithub.com/Lidong-io/cve-2022-29464★ 5githubgithub.com/r4x0r1337/-CVE-2022-29464★ 4githubgithub.com/hupe1980/CVE-2022-29464★ 3githubgithub.com/gpiechnik2/nmap-CVE-2022-29464★ 3githubgithub.com/tufanturhan/wso2-rce-cve-2022-29464★ 2githubgithub.com/mr-r3bot/WSO2-CVE-2022-29464★ 2githubgithub.com/superzerosec/CVE-2022-29464★ 2githubgithub.com/Pushkarup/CVE-2022-29464★ 1githubgithub.com/axin2019/CVE-2022-29464★ 1githubgithub.com/devengpk/CVE-2022-29464★ 1githubgithub.com/LinJacck/CVE-2022-29464★ 1githubgithub.com/amit-pathak009/CVE-2022-29464-mass★ 1githubgithub.com/hxlxmj/Mass-exploit-CVE-2022-29464★ 1githubgithub.com/Pasch0/WSO2RCE★ 1githubgithub.com/0xAgun/CVE-2022-29464★ 1githubgithub.com/amit-pathak009/CVE-2022-29464★ 0githubgithub.com/cc3305/CVE-2022-29464★ 0githubgithub.com/SynixCyberCrimeMy/CVE-2022-29464★ 0githubgithub.com/h3x0v3rl0rd/CVE-2022-29464★ 0githubgithub.com/lowkey0808/cve-2022-29464★ 0githubgithub.com/c1ph3rbyt3/CVE-2022-29464★ 0vulncheckvulncheck.com/xdb/86a670679b59unverifiedvulncheckvulncheck.com/xdb/91f9d53e4538unverifiedvulncheckvulncheck.com/xdb/82f284db0232unverifiedvulncheckvulncheck.com/xdb/f381bd45a664unverifiedvulncheckvulncheck.com/xdb/b3297f4dd55cunverifiedvulncheckvulncheck.com/xdb/057c3b65744eunverifiedvulncheckvulncheck.com/xdb/d98d3fe174f9unverifiedvulncheckvulncheck.com/xdb/4cebccad9591unverifiedvulncheckvulncheck.com/xdb/25b8cf7cf6ebunverifiedvulncheckvulncheck.com/xdb/6e191d63435cunverifiedvulncheckvulncheck.com/xdb/4e7a9bd58059unverifiedvulncheckvulncheck.com/xdb/22701ee3665funverifiedvulncheckvulncheck.com/xdb/4f25268c67fcunverifiedvulncheckvulncheck.com/xdb/4ba21cf083bdunverifiedvulncheckvulncheck.com/xdb/952320451d65unverifiedvulncheckvulncheck.com/xdb/549d7340c8e0unverifiedvulncheckvulncheck.com/xdb/7f516b37ed3cunverifiedvulncheckvulncheck.com/xdb/4235d5d6b4e9unverifiedvulncheckvulncheck.com/xdb/3a64e47558e3unverifiedvulncheckvulncheck.com/xdb/7b4c3e873b2bunverifiedvulncheckvulncheck.com/xdb/3b6044ea99eeunverifiedvulncheckvulncheck.com/xdb/a314ef693fd1unverifiedvulncheckvulncheck.com/xdb/37519b0063e5unverifiedvulncheckvulncheck.com/xdb/f55785d21de5unverifiedvulncheckvulncheck.com/xdb/9f32c4dfe4e8unverifiedcve_referencepacketstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/c0f15d01be06unverifiedvulncheckvulncheck.com/xdb/7407640180cbunverifiedvulncheckvulncheck.com/xdb/eda98189c7b4unverifiedvulncheckvulncheck.com/xdb/692f8dbe0563unverifiedvulncheckvulncheck.com/xdb/f5b17b3bfaceunverifiedvulncheckvulncheck.com/xdb/fb07ec0c6437unverifiedvulncheckvulncheck.com/xdb/11fb9f164ff9unverifiedvulncheckvulncheck.com/xdb/00ad5fff1b1dunverifiedvulncheckvulncheck.com/xdb/0a4c343b0014unverifiedvulncheckvulncheck.com/xdb/5c2ba6bd6d73unverifiedvulncheckvulncheck.com/xdb/51ec326380b8unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.htmlhttps://github.com/hakivvi/CVE-2022-29464https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464http://www.openwall.com/lists/oss-security/2022/04/22/7