CVE-2021-42646
📋 TL;DR
This CVE describes an XML External Entity (XXE) vulnerability in WSO2 API Manager and Identity Server management consoles. Attackers can exploit it via crafted GET requests to read sensitive files from the server or cause denial of service. Organizations running affected versions of WSO2 products with internet-facing management consoles are at risk.
💻 Affected Systems
- WSO2 API Manager
- WSO2 IS as Key Manager
- WSO2 Identity Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through sensitive file disclosure (including configuration files, credentials, private keys), leading to data breach and potential lateral movement within the network.
Likely Case
Unauthorized reading of sensitive server files containing configuration data, credentials, or system information that could enable further attacks.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to management interfaces.
🎯 Exploit Status
Exploitation requires access to the management console interface. Public proof-of-concept code exists demonstrating file disclosure via XXE injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply security patches from WSO2 security advisory WSO2-2021-1289
Vendor Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/
Restart Required: Yes
Instructions:
1. Review WSO2 security advisory WSO2-2021-1289. 2. Apply the provided security patches. 3. Restart affected WSO2 services. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Disable XXE Processing
allConfigure XML parsers to disable external entity processing
Modify XML parser configuration to set: feature("http://apache.org/xml/features/disallow-doctype-decl", true);
Set: feature("http://xml.org/sax/features/external-general-entities", false);
Set: feature("http://xml.org/sax/features/external-parameter-entities", false);
Restrict Management Console Access
allLimit access to management console to trusted IP addresses only
Configure firewall rules to restrict access to management console ports (typically 9443)
Use network security groups or iptables to allow only specific source IPs
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WSO2 management interfaces from untrusted networks
- Deploy a web application firewall (WAF) with XXE protection rules in front of the management console
🔍 How to Verify
Check if Vulnerable:
Test the management console endpoint with XXE payloads targeting the file-based service provider creation feature. Monitor for successful file disclosure.Check Version:
Check WSO2 product version in management console dashboard or review product distribution filesVerify Fix Applied:
Attempt the same XXE exploitation after patching. Successful fix should return error messages or block the XXE payload instead of disclosing file contents.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in WSO2 logs
- Multiple failed authentication attempts to management console followed by XML payload requests
- GET requests containing XML entities like &xxe; or file:/// paths
Network Indicators:
- HTTP requests to management console endpoints with XML content in parameters
- Unusual outbound connections from WSO2 server following XXE exploitation
SIEM Query:
source="wso2-carbon.log" AND ("XML" OR "DOCTYPE" OR "ENTITY") AND ("error" OR "exception")🔗 References
- http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html
- http://seclists.org/fulldisclosure/2022/Jun/7
- https://github.com/wso2/carbon-identity-framework/pull/3472
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/
- http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html
- http://seclists.org/fulldisclosure/2022/Jun/7
- https://github.com/wso2/carbon-identity-framework/pull/3472
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/
