CVE-2022-29464
📋 TL;DR
CVE-2022-29464 is a critical unrestricted file upload vulnerability in multiple WSO2 products that allows attackers to upload malicious files to web-accessible directories via directory traversal. This leads to remote code execution by uploading webshells or other executable content. Affected organizations include those using WSO2 API Manager, Identity Server, Enterprise Integrator, and Open Banking components within specified vulnerable versions.
💻 Affected Systems
- WSO2 API Manager
- WSO2 Identity Server
- WSO2 Identity Server Analytics
- WSO2 Identity Server as Key Manager
- WSO2 Enterprise Integrator
- WSO2 Open Banking AM
- WSO2 Open Banking KM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the affected server, enabling data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to webshell deployment, credential harvesting, and potential data exfiltration from the compromised system.
If Mitigated
Limited impact with proper network segmentation and file upload restrictions, potentially only allowing file upload without execution.
🎯 Exploit Status
Multiple public exploit scripts and proof-of-concepts are available; exploitation is straightforward with known directory paths.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WSO2 has released security updates for all affected products; specific versions vary by product line.
Vendor Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/
Restart Required: Yes
Instructions:
1. Identify affected WSO2 product and version. 2. Download and apply the latest security patch from WSO2's official security advisory. 3. Restart the WSO2 service to apply changes. 4. Verify the patch by checking version and testing the /fileupload endpoint.
🔧 Temporary Workarounds
Block /fileupload endpoint
allConfigure web server or firewall rules to block access to the vulnerable /fileupload endpoint.
# Example for Apache: RewriteRule ^/fileupload - [F,L]
# Example for Nginx: location ~ /fileupload { deny all; }
Restrict file upload directory permissions
linuxSet strict file permissions on web-accessible directories to prevent execution of uploaded files.
chmod -R 644 /path/to/webapps/
chown -R root:root /path/to/webapps/
🧯 If You Can't Patch
- Implement strict network access controls to limit access to WSO2 management interfaces
- Deploy web application firewall (WAF) rules to detect and block directory traversal attempts in file upload requests
🔍 How to Verify
Check if Vulnerable:
Check if the /fileupload endpoint is accessible and test with a benign file upload containing directory traversal sequences (e.g., ../../test.txt).Check Version:
Check WSO2 product documentation for version command; typically found in management console or product logs.Verify Fix Applied:
Verify the WSO2 product version is updated beyond vulnerable ranges and test that /fileupload endpoint no longer accepts directory traversal sequences.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload requests to /fileupload endpoint
- HTTP requests containing directory traversal sequences (../)
- Unexpected file creations in webapps directories
Network Indicators:
- POST requests to /fileupload with Content-Disposition headers containing ../ patterns
- Unusual outbound connections from WSO2 servers post-file upload
SIEM Query:
source="*wso2*" AND (url="/fileupload" OR message="*../*")🔗 References
- http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2022/04/22/7
- https://github.com/hakivvi/CVE-2022-29464
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/
- http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2022/04/22/7
- https://github.com/hakivvi/CVE-2022-29464
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464
