Vulnerability record · CVE-2022-29464 · published 18 April 2022
CVE-2022-29464: WSO2 products path traversal file upload leads to RCE
Wso2 · Api Manager
Multiple WSO2 products accept unrestricted file uploads through a /fileupload endpoint, and a Content-Disposition directory traversal sequence lets an attacker write files into directories under the web root such as ../../../../repository/deployment/server/webapps. Because the uploaded file lands in a web-accessible location, it can be executed as code, giving full remote code execution. The flaw affects a wide range of WSO2 API Manager, Identity Server, Enterprise Integrator and Open Banking releases.
Description
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8, KEV listing, known ransomware use, and near-certain EPSS probability.
What it is
Multiple WSO2 products accept unrestricted file uploads through a /fileupload endpoint, and a Content-Disposition directory traversal sequence lets an attacker write files into directories under the web root such as ../../../../repository/deployment/server/webapps. Because the uploaded file lands in a web-accessible location, it can be executed as code, giving full remote code execution. The flaw affects a wide range of WSO2 API Manager, Identity Server, Enterprise Integrator and Open Banking releases.
Impact
An unauthenticated attacker gains remote code execution on the WSO2 server, allowing arbitrary commands, data theft, and full compromise of the host and any credentials or services it manages.
Attack surface
Reachable over the network via HTTP requests to the /fileupload endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
CISA added it to KEV on 2022-04-25 with a 2022-05-16 remediation due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99999 and public exploit references exist.
What to do
- Apply the vendor updates listed in WSO2 security advisory WSO2-2021-1738 for all affected products and versions.
- If immediate patching is not possible, restrict or block external access to the /fileupload endpoint and the affected management interfaces.
- Remove or disable unused WSO2 components and webapps to reduce the exposed upload surface.
- Monitor and restrict write access to web root directories such as repository/deployment/server/webapps.
- After patching, review the webapps directories for unexpected files and treat any found as a compromise indicator.
Detection
- Search web and proxy logs for POST requests to /fileupload, especially with Content-Disposition headers containing ../ traversal sequences.
- Alert on new or modified files appearing under repository/deployment/server/webapps and other web root paths.
- Monitor for unexpected child processes spawned by the WSO2 Java process, such as shells or scripting interpreters.
- Review WSO2 server logs and file integrity monitoring for uploads followed by execution of newly written files.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-29464 to the Known Exploited Vulnerabilities catalog on 25 April 2022 as "WSO2 Multiple Products Unrestrictive Upload of File Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 16 May 2022.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| http://www.openwall.com/lists/oss-security/2022/04/22/7 | Mailing ListThird Party Advisory |
| https://github.com/hakivvi/CVE-2022-29464 | ExploitThird Party Advisory |
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ | Vendor Advisory |
| http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| http://www.openwall.com/lists/oss-security/2022/04/22/7 | Mailing ListThird Party Advisory |
| https://github.com/hakivvi/CVE-2022-29464 | ExploitThird Party Advisory |
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/ | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464 | US Government Resource |
Track CVE-2022-29464 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-29464), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.
