CVE-2024-7097
📋 TL;DR
This vulnerability allows attackers to create unauthorized user accounts in WSO2 products regardless of self-registration settings. It affects WSO2 products with SOAP admin service enabled. Attackers can create low-privileged accounts to gain initial access to systems.
💻 Affected Systems
- WSO2 API Manager
- WSO2 Identity Server
- WSO2 Enterprise Integrator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Mass account creation leads to system resource exhaustion, denial of service, and persistent unauthorized access enabling further attacks.
Likely Case
Attackers create multiple low-privileged accounts to establish foothold for privilege escalation or lateral movement.
If Mitigated
Limited to creating low-privileged accounts that can be detected and removed before causing significant damage.
🎯 Exploit Status
Exploitation requires network access to SOAP admin service endpoint but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific product versions
Vendor Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/
Restart Required: Yes
Instructions:
1. Review vendor advisory for affected versions. 2. Apply recommended patches. 3. Restart affected services. 4. Verify patch application.
🔧 Temporary Workarounds
Disable SOAP Admin Service
allDisable the vulnerable SOAP admin service endpoint
Edit configuration files to disable SOAP admin service or restrict access via firewall rules
Network Access Control
linuxRestrict network access to SOAP admin service endpoints
iptables -A INPUT -p tcp --dport [SOAP_PORT] -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="[TRUSTED_NETWORK]" port protocol="tcp" port="[SOAP_PORT]" accept'
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WSO2 instances
- Enable detailed logging and monitoring for user creation events
🔍 How to Verify
Check if Vulnerable:
Test if unauthorized user creation is possible via SOAP admin service endpointCheck Version:
Check product version in admin console or configuration filesVerify Fix Applied:
Attempt to create user via SOAP admin service without proper authorization - should fail📡 Detection & Monitoring
Log Indicators:
- Unexpected user creation events
- Multiple failed authentication attempts followed by successful user creation
- SOAP admin service access from unusual IPs
Network Indicators:
- Unusual SOAP traffic patterns
- Multiple POST requests to user creation endpoints
SIEM Query:
source="wso2-logs" AND (event="user_creation" OR event="account_creation") AND result="success" | stats count by src_ip