CVE-2022-29464

Deeper analysis

CVE-2022-29464 is an unrestricted file upload vulnerability that permits remote code execution through directory traversal. It affects multiple WSO2 products including API Manager versions 2.2.0 through 4.0.0, Identity Server 5.2.0 through 5.11.0, Identity Server as Key Manager 5.3.0 through 5.11.0, Enterprise Integrator 6.2.0 through 6.6.0, and several related Open Banking and analytics components. The flaw resides in the handling of the /fileupload endpoint, where an attacker-supplied Content-Disposition header containing sequences such as ../../../../repository/deployment/server/webapps allows placement of arbitrary files under the web root.

Unauthenticated remote attackers can exploit the issue over the network by sending a crafted multipart request to the vulnerable endpoint. Successful exploitation grants the ability to write executable code into a web-accessible directory, resulting in full compromise of the confidentiality, integrity, and availability of the affected server with a CVSS score of 9.8.

WSO2 has published a security advisory (WSO2-2021-1738) that describes the affected versions and provides mitigation guidance; public proof-of-concept code and exploit modules have also been released. The associated EPSS score has reached a peak of 0.9750 with a current value of 0.9443, indicating sustained exploitation interest following disclosure.