Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

对生成代码的控制不恰当(代码注入)

WSO2多款产品 安全漏洞

WSO2 API Manager等都是美国WSO2公司的产品。WSO2 API Manager是一套API生命周期管理解决方案。WSO2 Enterprise Integrator是一套开源的混合集成平台。WSO2 Micro Integrator是一个分布式微服务集成层。 WSO2多款产品存在安全漏洞，该漏洞源于GraalJS和NashornJS Script Mediator引擎限制不足，可能导致特权用户执行任意代码。以下产品受到影响：WSO2 Micro Integrator、WSO2 Enterp

N/A

N/A