WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464) - Nessus

Critical   Plugin ID: 160208

This page contains detailed information about the WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Table Of Contents
hide

Plugin Overview

ID: 160208
Name: WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464)
Filename: wso2_CVE-2022-29464.nbin
Vulnerability Published: 2022-04-01
This Plugin Published: 2022-04-26
Last Modification Time: 2022-05-03
Plugin Version: 1.4
Plugin Type: remote
Plugin Family: CGI abuses
Dependencies: http_version.nasl

Vulnerability Information

Severity: Critical
Vulnerability Published: 2022-04-01
Patch Published: 2022-04-01
CVE [?]: CVE-2022-29464
CPE [?]: cpe:/a:wso2:api_manager, cpe:/a:wso2:enterprise_integrator, cpe:/a:wso2:identity_server, cpe:/a:wso2:identity_server_analytics, cpe:/a:wso2:identity_server_as_key_manager

Synopsis

The remote web server is affected by a file upload remote command execution vulnerability.

Description

The remote web server is running a WSO2 product that is affected by a file upload remote command execution vulnerability due to improper validation of user input. A remote, unauthenticated attacker can leverage this by uploading a malicious jsp script to the web server resulting in remote command execution.

Note that Nessus tests for this vulnerability by sending a benign POST request to the vulnerable endpoint and analyzes the response to determine if the vulnerability is present or has been patched or mitigated.

Solution

Upgrade to a patched version according to the vendor advisory.

Public Exploits

Target Network Port(s): 9443
Target Asset(s): Services/www
Exploit Available: True (Metasploit Framework, GitHub)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464) vulnerability:

  1. Metasploit: exploit/multi/http/wso2_file_upload_rce
    [WSO2 Arbitrary File Upload to RCE]
  2. GitHub: https://github.com/0xAgun/CVE-2022-29464
    [CVE-2022-29464]
  3. GitHub: https://github.com/axin2019/CVE-2022-29464
    [CVE-2022-29464: 1]
  4. GitHub: https://github.com/gpiechnik2/nmap-CVE-2022-29464
    [CVE-2022-29464: Repository containing nse script for vulnerability CVE-2022-29464 known as WSO2 RCE. ...]
  5. GitHub: https://github.com/h3v0x/CVE-2022-29464
    [CVE-2022-29464: WSO2 RCE (CVE-2022-29464)]
  6. GitHub: https://github.com/k4u5h41/CVE-2022-29464
    [CVE-2022-29464]
  7. GitHub: https://github.com/lowkey0808/cve-2022-29464
    [CVE-2022-29464]
  8. GitHub: https://github.com/mr-r3bot/WSO2-CVE-2022-29464
    [CVE-2022-29464: Pre-auth RCE bug CVE-2022-29464]
  9. GitHub: https://github.com/superzerosec/CVE-2022-29464
    [CVE-2022-29464: CVE-2022-29464 POC exploit]
  10. GitHub: https://github.com/tufanturhan/wso2-rce-cve-2022-29464
    [CVE-2022-29464]
  11. GitHub: https://github.com/hakivvi/CVE-2022-29464
    [CVE-2022-29464: WSO2 RCE (CVE-2022-29464) exploit and writeup.]
  12. GitHub: https://github.com/Lidong-io/cve-2022-29464
    [CVE-2022-29464: Cve-2022-29464 批量脚本]
  13. GitHub: https://github.com/oppsec/WSOB
    [CVE-2022-29464: 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned ...]
  14. GitHub: https://github.com/UUFR/CVE-2022-29464
    [CVE-2022-29464]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

CVSS Score Source [?]: CVE-2022-29464
CVSS V2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C
CVSS Base Score:10.0 (High)
Impact Subscore:10.0
Exploitability Subscore:10.0
CVSS Temporal Score:8.7 (High)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:8.7 (High)
CVSS V3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
CVSS Base Score:9.8 (Critical)
Impact Subscore:5.9
Exploitability Subscore:3.9
CVSS Temporal Score:9.4 (Critical)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:9.4 (Critical)

Go back to menu.

Plugin Source

The wso2_CVE-2022-29464.nbin Nessus plugin is distributed in a propriatory binary format and its source code is protected. This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.

The latest version of this script can be found in these locations depending on your platform:

  • Linux / Unix:
    /opt/nessus/lib/nessus/plugins/wso2_CVE-2022-29464.nbin
  • Windows:
    C:\ProgramData\Tenable\Nessus\nessus\plugins\wso2_CVE-2022-29464.nbin
  • Mac OS X:
    /Library/Nessus/run/lib/nessus/plugins/wso2_CVE-2022-29464.nbin

Go back to menu.

How to Run

Here is how to run the WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

  1. Click to start a New Scan.
  2. Select Advanced Scan.
  3. Navigate to the Plugins tab.
  4. On the top right corner click to Disable All plugins.
  5. On the left side table select CGI abuses plugin family.
  6. On the right side table select WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464) plugin ID 160208.
  7. Specify the target on the Settings tab and click to Save the scan.
  8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl wso2_CVE-2022-29464.nbin -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a wso2_CVE-2022-29464.nbin -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - wso2_CVE-2022-29464.nbin -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state wso2_CVE-2022-29464.nbin -t <IP/HOST>

Go back to menu.

References

See also: Similar and related Nessus plugins:
  • 130263 - Adobe ColdFusion File Upload (APSB18-33) (CVE-2018-15961)
  • 39790 - Adobe ColdFusion FCKeditor 'CurrentFolder' File Upload
  • 16061 - e107 Image Manager Unauthorized File Upload
  • 39806 - FCKeditor 'CurrentFolder' Arbitrary File Upload
  • 21780 - FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
  • 69273 - Joomla! 2.5.x < 2.5.14 / 3.x < 3.1.5 .php. File Upload RCE
  • 64470 - Collector Component for Joomla! File Upload RCE
  • 79420 - Creative Contact Form Component for Joomla! File Upload RCE
  • 25736 - Expose for Joomla! File Upload RCE
  • 118310 - jQuery-File-Upload Arbitrary File Upload Vulnerability (Remote Check)
  • 58654 - Lenovo ThinkManagement Console RunAMTCommand Operation -PutUpdateFileCore Command Parsing Arbitrary File Upload
  • 22367 - Limbo Contact Component (com_contact) contact.html.php contact_attach Unrestricted File Upload
  • 82078 - ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)
  • 82079 - ManageEngine Desktop Central Arbitrary File Upload and RCE (Safe Check)
  • 71217 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)
  • 71218 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload
  • 143600 - ManageEngine ServiceDesk Plus < 10.0 Build 10012 Arbitrary File Upload
  • 63638 - MoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite
  • 47581 - Novell 'modulemanager' Servlet Arbitrary File Upload (intrusive check)
  • 47582 - Novell 'modulemanager' Servlet Arbitrary File Upload (safe check)
  • 66914 - Novell ZENworks Control Center File Upload Remote Code Execution (intrusive check)
  • 35261 - OneOrZero Helpdesk tinfo.php Arbitrary File Upload
  • 49271 - OpenX Open Flash Chart ofc_upload_image.php File Upload Arbitrary Code Execution
  • 51119 - Sitefinity CMS Arbitrary File Upload
  • 22303 - TikiWiki jhot.php Arbitrary File Upload
  • 56735 - TimThumb Cache Directory 'src' Parameter Arbitrary PHP File Upload
  • 61517 - Umbraco codeEditorSave.asmx SaveDLRScript Operation Traversal File Upload Arbitrary Command Execution
  • 80083 - Visual Mining NetCharts Server Arbitrary File Upload
  • 105732 - Western Digital MyCloud Unauthenticated File Upload
  • 79421 - Creative Contact Form Plugin for WordPress File Upload RCE
  • 76526 - MailPoet Newsletters for WordPress Arbitrary File Upload
  • 105372 - WP Symposium Plugin Arbitrary File Upload

Version

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file wso2_CVE-2022-29464.nbin version 1.4. For more plugins, visit the Nessus Plugin Library.

Go back to menu.