Attack Chain

1. An attacker sends an unauthenticated HTTP POST request to the /fileupload endpoint.
2. The CarbonUILoginUtil.handleLoginPageRequest() utility incorrectly identifies the /fileupload path as exempt from security checks and returns RETURN_TRUE.
3. The FileUploadServlet receives the request and passes it to the FileUploadExecutorManager.
4. The manager uses the actionString extracted from the URL to map the request to a specific FileUploadExecutor class.
5. The attacker provides a Content-Disposition header containing directory traversal sequences (e.g., ../../../../) to escape the intended upload directory.
6. The application writes the uploaded JSP file into the web server deployment directory.
7. The attacker requests the newly uploaded JSP file to trigger arbitrary code execution.

Impact

Successful exploitation allows unauthenticated attackers to achieve Remote Code Execution (RCE) on the underlying host, leading to full system compromise.

Recommendation

1. Inventory all instances of WSO2 API Manager, Enterprise Integrator, Identity Server, and Identity Server Analytics.
2. Patch affected software to the versions remediating CVE-2022-29464 as provided by WSO2.
3. Implement network-level restrictions to block access to the /fileupload path for all untrusted users.
4. Monitor web server access logs for POST requests to /fileupload that contain directory traversal patterns (e.g., ..%2F or ../) in the request URI or parameters.