Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

危险类型文件的不加限制上传

WSO2 API Manager 安全漏洞

WSO2 API Manager是美国WSO2公司的一套API生命周期管理解决方案。 WSO2 API Manager存在安全漏洞，该漏洞源于SOAP管理服务中用户输入验证不当，可能导致任意文件上传。

N/A

N/A