CVE-2022-29548 PoC — WSO2 多个产品跨站脚本漏洞

Source

https://github.com/cxosmo/CVE-2022-29548

Associated Vulnerability

Title:WSO2 多个产品跨站脚本漏洞 (CVE-2022-29548)
Description:WSO2 API Manager等都是美国WSO2公司的产品。WSO2 API Manager是一套API生命周期管理解决方案。WSO2 Dashboard Server是一款仪表板服务器。WSO2 Identity Server（IS）是一款身份认证服务器。 WSO2 多个产品存在安全漏洞，该漏洞源于输出编码不正确。攻击者利用此漏洞可以使浏览器重定向到恶意网站，在网页 UI 中进行更改，从浏览器中检索信息或以其他方式造成伤害。以下产品和版本受到影响：WSO2 API Manager : 2.2.0,2.

Description

Proof of concept exploit for CVE-2022-29548: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

Readme

Proof of concept exploit for CVE-2022-29548: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

# References
[MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29548)

[Vendor Advisory](https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603)

[Fix Implementation](https://github.com/wso2/carbon-kernel/pull/3145)

# PoC Notes
* Tested against: `WSO2 API Manager 4.0.0`
* Payload snippet: `https://localhost:9443/carbon/admin/login.jsp?loginStatus=false&errorCode=%27);alert(document.domain)//`

File Snapshot


 [4.0K]  /data/pocs/d7208e87abae0ab482279bfd41b2e1211ece9e0b
├── [2.9K]  CVE-2022-29548.py
└── [ 992]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!