Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-1248— Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

Quick assessment

Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WSO2 API Manager是美国WSO2公司开源的一套API生命周期管理解决方案。 WSO2 API Manager、WSO2 Identity Server as Key Manager和WSO2 Open Banking IAM存在加密问题漏洞，该漏洞源于联邦身份认证实现中的静默即时（JIT）预配置功能在账户创建时未正确隔离用户角色，当联邦用户与本地用户共享用户名时，预配置过程可能用分配给联邦用户的角色覆盖本地用户现有角色。成功利用此漏洞需要联邦身份提供商（IDP）启用静默JIT预配置，且攻击者

CVSS 4.8 · Medium EPSS 0.30% · P21

Affected Version Matrix 18

VendorProduct Version RangeStatus
WSO2 WSO2 API Manager < 3.0.0 unknown
3.0.0< 3.0.0.153 affected
3.1.0< 3.1.0.267 affected
3.2.0< 3.2.0.351 affected
4.0.0< 4.0.0.269 affected
4.1.0< 4.1.0.169 affected
WSO2 WSO2 Identity Server < 5.8.0 unknown
5.8.0< 5.8.0.101 affected
5.9.0< 5.9.0.138 affected
5.10.0< 5.10.0.284 affected
5.11.0< 5.11.0.321 affected
WSO2 WSO2 Identity Server as Key Manager < 5.9.0 unknown
5.9.0< 5.9.0.148 affected
5.10.0< 5.10.0.280 affected
WSO2 WSO2 Open Banking AM < 2.0.0 unknown
2.0.0< 2.0.0.313 affected
WSO2 WSO2 Open Banking IAM < 2.0.0 unknown
2.0.0< 2.0.0.333 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-1248

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
Source: CVE Program / CVE List V5
Vulnerability Description
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When these conditions are met, a malicious individual can leverage the JIT provisioning process to modify the roles of local users. The overwritten roles are limited to those defined within the federated IDP, typically granting minimal access rights unless explicitly configured otherwise by the federated IDP administrator.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
证书过期验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
wso2 api manager 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WSO2 API Manager是美国WSO2公司开源的一套API生命周期管理解决方案。 WSO2 API Manager、WSO2 Identity Server as Key Manager和WSO2 Open Banking IAM存在加密问题漏洞，该漏洞源于联邦身份认证实现中的静默即时（JIT）预配置功能在账户创建时未正确隔离用户角色，当联邦用户与本地用户共享用户名时，预配置过程可能用分配给联邦用户的角色覆盖本地用户现有角色。成功利用此漏洞需要联邦身份提供商（IDP）启用静默JIT预配置，且攻击者
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Manager 3.0.0 ~ 3.0.0.153 -
WSO2 WSO2 Identity Server 5.8.0 ~ 5.8.0.101 -
WSO2 WSO2 Identity Server as Key Manager 5.9.0 ~ 5.9.0.148 -
WSO2 WSO2 Open Banking AM 2.0.0 ~ 2.0.0.313 -
WSO2 WSO2 Open Banking IAM 2.0.0 ~ 2.0.0.333 -

II. Public POCs for CVE-2024-1248

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-1248

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-1248 (1)

IV. Related Vulnerabilities

Same product: WSO2 API Manager
Same vendor: WSO2
Same weakness: CWE-298

V. Comments for CVE-2024-1248

No comments yet

Leave a comment