The PoC explains the possibility of placing files in other paths of /authenticationendpoint/, but it is notable that many of the observed attacks are very persistent in the existing PoC implementations. We observed the installation of web shells abusing the vulnerability, and looking at the proof of concept for this gap, a single malicious Jakarta Server Pages (.JSP, formerly JavaServer Pages) file can be uploaded under locations such as /repository/deployment/server/webapps/authenticationendpoint/>.

The gap specifically affects WSO2 API Manager 2.2.0 and above, Identity Server 5.2.0 and above, Identity Server Analytics 5.4.0 to 5.6.0, Identity Server as Key Manager 5.3.0 and above, Open Banking AM 1.4.0 and above, and Enterprise Integrator 6.2.0 and above. Approximately a week later, the Metasploit module for the affected environment was available. On April 20, a GitHub user with the handle “ hakkivi” published a proof of the exploit, and we observed exploits to the affected environments the next day.

The vulnerability in WSO2 products was disclosed on April 18 by a user named Orange Tsai, and subsequently given its respective CVE ID and patched. It requires no user interaction and administrative privileges for abuse, and can be used to infiltrate networks when left unpatched. Disclosed and patched in April, the security gap was ranked Critical at 9.8 and affects a number of WSO2 products. We observed vulnerability CVE-2022-29464 being exploited in the wild since April, allowing unrestricted file uploads resulting to arbitrary remote code execution (RCE).

Strike instaling