CVE-2022-29464
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Description
CVE-2022-29464 is an unrestricted file upload vulnerability affecting multiple WSO2 products, including WSO2 API Manager, Identity Server, Enterprise Integrator, and Open Banking. This critical security flaw allows an unauthenticated remote attacker to upload arbitrary files to the server, resulting in remote code execution. The unrestricted file upload vulnerability in WSO2 products enables attackers to deploy web shells and gain full control over the compromised server. CISA has added CVE-2022-29464 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022, and the vulnerability is known to be used in ransomware campaigns. The EPSS percentile of approximately 99.99% confirms this is among the most actively exploited vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| wso2 | api manager | >= 2.2.0, <= 4.0.0 |
| wso2 | enterprise integrator | >= 6.2.0, <= 6.6.0 |
| wso2 | identity server | >= 5.2.0, <= 5.11.0 |
| wso2 | identity server analytics | 5.4.0; 5.4.1; 5.5.0; 5.6.0 |
| wso2 | identity server as key manager | >= 5.3.0, <= 5.10.0 |
| wso2 | open banking am | >= 1.3.0, <= 2.0.0 |
| wso2 | open banking iam | 2.0.0 |
| wso2 | open banking km | >= 1.3.0, <= 1.5.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2022/04/22/7(Mailing List, Third Party Advisory)
- https://github.com/hakivvi/CVE-2022-29464(Exploit, Third Party Advisory)
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
The unrestricted file upload vulnerability in WSO2 products occurs when the application fails to properly validate the type, content, or size of uploaded files. In CVE-2022-29464, WSO2 product endpoints accept file uploads without adequate authentication or file type restrictions, allowing attackers to upload executable files such as JSP web shells that are then processed by the server, enabling arbitrary code execution.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2022-29464 is remotely exploitable over the network without any authentication or user interaction, making it trivially exploitable at scale. The vulnerability allows an unauthenticated attacker to upload arbitrary files, including web shells and malicious executables, to the WSO2 server, achieving immediate remote code execution. Successful exploitation provides the attacker with the same privileges as the WSO2 application server process, typically enabling full server compromise including access to all data processed by the WSO2 platform, modification of configurations and user data, and potential disruption of all services hosted on the server. The EPSS percentile of approximately 99.99% indicates near-certain exploitation activity, and CISA has confirmed that CVE-2022-29464 is known to be used in ransomware attacks, significantly elevating the risk for organizations running vulnerable WSO2 deployments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-29464 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The vulnerability is known to be used in ransomware campaigns, indicating that criminal groups are actively leveraging this flaw for financial extortion. The EPSS percentile of approximately 99.99% indicates near-certain exploitation activity, placing this vulnerability at the very top of the exploitation probability spectrum. The simplicity of exploitation, requiring only an unauthenticated HTTP request to upload a web shell, combined with the critical impact of remote code execution, makes CVE-2022-29464 an extremely high-priority threat that demands immediate remediation.
Remediation
-
Apply WSO2 security updates immediately as directed by CISA: "Apply updates per vendor instructions." Update all affected WSO2 products including API Manager, Identity Server, Enterprise Integrator, and Open Banking to patched versions that address the unrestricted file upload vulnerability.
-
Scan for indicators of compromise before and after patching, as the vulnerability may have already been exploited. Check for unauthorized web shells in WSO2 deployment directories, review server access logs for suspicious file upload requests, and search for unexpected files with executable extensions (.jsp, .war, .jar) in web application directories.
-
Restrict network access to WSO2 management interfaces by placing all WSO2 product endpoints behind a web application firewall (WAF) and restricting access to management consoles and file upload endpoints to trusted IP ranges only. Block unauthenticated access to file upload paths at the network perimeter.
-
Implement file upload validation at the application and WAF level to reject uploads of executable file types. Configure WAF rules to inspect file content types and block uploads that contain server-side executable code, particularly JSP, WAR, and JAR files from untrusted sources.
-
Prepare ransomware incident response procedures given the confirmed use of this vulnerability in ransomware campaigns. Ensure offline backups are current and tested, isolate potentially compromised WSO2 servers from the network, and engage incident response resources if any indicators of compromise are discovered.
Technical Details
CVE-2022-29464 is an unrestricted file upload vulnerability (CWE-434) in multiple WSO2 products that allows unauthenticated attackers to upload arbitrary files via HTTP requests to specific server endpoints. The vulnerability stems from insufficient validation of uploaded files, including missing authentication checks on file upload handlers and the absence of file type restrictions that would prevent the upload of executable content such as JSP web shells. Once a web shell is uploaded to the WSO2 server's web-accessible directory, it is automatically deployed and accessible to the attacker, providing an interactive command execution interface on the compromised server. The attack requires no authentication, no user interaction, and can be executed with a simple HTTP POST request, making it trivially exploitable with basic tools such as curl or purpose-built exploit scripts that have been widely circulated since disclosure.
Frequently Asked Questions
Is CVE-2022-29464 being actively exploited?
Yes, CVE-2022-29464 is being actively exploited in the wild, including in ransomware campaigns. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 99.99% confirms this is among the most actively exploited vulnerabilities.
What products are affected by CVE-2022-29464?
CVE-2022-29464 affects multiple WSO2 products including WSO2 API Manager, WSO2 Identity Server, WSO2 Enterprise Integrator, and WSO2 Open Banking. Organizations running any of these products should verify their version and apply patches immediately.
How do I fix CVE-2022-29464?
Apply the WSO2 security updates for all affected products immediately. Scan for indicators of compromise including unauthorized web shells before and after patching. Restrict network access to WSO2 management interfaces and implement WAF rules to block malicious file uploads.
How severe is CVE-2022-29464?
CVE-2022-29464 is an extremely severe vulnerability with an EPSS percentile of approximately 99.99% and confirmed use in ransomware attacks. The unrestricted file upload flaw allows unauthenticated remote code execution, enabling complete server compromise without any authentication or user interaction.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.