Published: 17th August 2020
CVSS Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
WSO2 API Manager : 3.1.0 or earlier
WSO2 API Microgateway : 2.2.0
Potential unauthenticated XML External Entity injection (XXE) and XML Entity Expansion vulnerabilities have been identified in the Management Console.
It was found that the Management Console is vulnerable to XML External Entity Injection and XML Entity Expansion attacks. A remote attacker could send unauthenticated requests with malicious payloads to the affected server.
An XML External Entity injection (XXE) often allows an attacker to view files on the server file system, and to interact with any backend or external systems that the application itself can access and allows the attacker to transmit sensitive data from the compromised server to a system that the attacker controls. An XML Entity Expansion attack might result in a denial-of-service condition, causing the entire application to stop functioning. It is possible to exploit both of the above vulnerabilities without authenticating to the Management Console.
If you are using an affected product version, it is highly recommended to migrate to the latest released version to receive security fixes.
You may also apply the relevant fixes based on the changes from the public fix: https://github.com/wso2/carbon-governance/pull/341 , https://github.com/wso2/carbon-governance/pull/340, https://github.com/wso2/carbon-governance/pull/339
Note: If you are a WSO2 customer with Support Subscription, please use WSO2 Update Manager (WUM) updates in order to apply the fix.
WSO2 thanks, Krzysztof Przybylski for responsibly reporting the identified issue and working with us as we addressed it.