WSO2: Unauthenticated Remote Code Execution via FileUploadServlet (CVE-2022-29464)

CVE-2022-29464 is a critical vulnerability affecting multiple WSO2 products. The vulnerability exists within the FileUploadServlet component, which is incorrectly configured to skip authentication checks for requests directed at the /fileupload endpoint. This allows unauthenticated attackers to leverage the FileUploadExecutorManager to upload arbitrary files. By manipulating the Content-Disposition header with directory traversal sequences, an attacker can write files into the web application root, such as JSP shells, achieving Remote Code Execution (RCE).

Attack Chain

1. An attacker sends an unauthenticated HTTP POST request to the /fileupload endpoint.
2. The CarbonUILoginUtil.handleLoginPageRequest() utility incorrectly identifies the /fileupload path as exempt from security checks and returns RETURN_TRUE.
3. The FileUploadServlet receives the request and passes it to the FileUploadExecutorManager.
4. The manager uses the actionString extracted from the URL to map the request to a specific FileUploadExecutor class.
5. The attacker provides a Content-Disposition header containing directory traversal sequences (e.g., ../../../../) to escape the intended upload directory.
6. The application writes the uploaded JSP file into the web server deployment directory.
7. The attacker requests the newly uploaded JSP file to trigger arbitrary code execution.

Impact

Successful exploitation allows unauthenticated attackers to achieve Remote Code Execution (RCE) on the underlying host, leading to full system compromise.

Recommendation

1. Inventory all instances of WSO2 API Manager, Enterprise Integrator, Identity Server, and Identity Server Analytics.
2. Patch affected software to the versions remediating CVE-2022-29464 as provided by WSO2.
3. Implement network-level restrictions to block access to the /fileupload path for all untrusted users.
4. Monitor web server access logs for POST requests to /fileupload that contain directory traversal patterns (e.g., ..%2F or ../) in the request URI or parameters.