CVE-2025-5350
📋 TL;DR
This vulnerability allows attackers to perform SSRF attacks and execute reflected XSS in WSO2 products through the deprecated Try-It feature. Only administrative users are affected, as exploitation requires tricking an admin into clicking a malicious link. Successful exploitation could lead to internal network enumeration and UI manipulation in the admin context.
💻 Affected Systems
- WSO2 API Manager
- WSO2 Identity Server
- WSO2 Enterprise Integrator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains admin privileges through XSS, exfiltrates sensitive data, and uses SSRF to pivot to internal systems for lateral movement.
Likely Case
Attacker uses XSS to manipulate admin UI for phishing or data theft, while SSRF reveals internal service information.
If Mitigated
Limited impact due to admin-only access requirement and HttpOnly cookies, but still enables UI manipulation and internal reconnaissance.
🎯 Exploit Status
Requires social engineering to trick admin into clicking malicious link
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific product versions
Vendor Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4124/
Restart Required: No
Instructions:
1. Review vendor advisory for affected products. 2. Apply recommended patches. 3. Verify Try-It feature is disabled or removed.
🔧 Temporary Workarounds
Disable Try-It Feature
allCompletely disable the deprecated Try-It feature in WSO2 configuration
Edit deployment.toml: [admin.try_it] enabled = false
Restrict Admin Access
allLimit administrative access to trusted networks and implement MFA
🧯 If You Can't Patch
- Disable Try-It feature immediately in all configurations
- Implement strict network segmentation to limit SSRF impact
- Train administrators to recognize phishing attempts
🔍 How to Verify
Check if Vulnerable:
Check if Try-It feature is enabled and accessible to admin usersCheck Version:
Check product version via management console or deployment filesVerify Fix Applied:
Verify Try-It feature is disabled or patched, test with controlled SSRF/XSS payloads📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from WSO2 server
- Admin accessing Try-It with suspicious URLs
Network Indicators:
- WSO2 server making unexpected internal network requests
SIEM Query:
source="wso2" AND (url_contains("try-it") OR outbound_request_to_internal_ip)