HTTP: WSO2 API Manager ToolsAnyFileUploadExecutor Directory Traversal
This signature detects attempts to exploit a known vulnerability against WSO2 API Manager. A successful attack can lead to directory traversal and arbitrary code execution.
Extended Description
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
Affected Products
Wso2 open_banking_iam
References
CVE: CVE-2022-29464
URL: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738
Short Name
HTTP:DIR:WSO2-API-FLE-UPLD-DTRV
Severity
Critical
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
API CVE-2022-29464 Directory Manager ToolsAnyFileUploadExecutor Traversal WSO2
Release Date
05/06/2022
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3719
False Positive
Unknown
Vendors
Wso2