Noël Maccary

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** A Cross-Site Request Forgery (CSRF) issue exists in multiple WSO2 products. This is due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. The SameSite=Lax cookie attribute does not effectively prevent exploitation in this context, as it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this by tricking an authenticated user into visiting a crafted link, causing the browser to issue unintended state-changing requests. Successful exploitation could lead to unauthorized operations, such as data modification or account changes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** The Try-It feature, accessible to administrative users, contains server-side request forgery (SSRF) and reflected cross-site scripting (XSS) issues. The feature does not properly validate user-supplied URLs, allowing SSRF. Retrieved content is directly reflected in the HTTP response, enabling reflected XSS within the admin user's browser. An attacker could trick an administrator into accessing a crafted link, causing the server to fetch malicious content and reflect it into the admin’s browser, potentially leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. SSRF can be used to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable. Session cookies are protected with the HttpOnly flag, but the XSS still presents a security risk. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** An authentication bypass exists in the Management Console of WSO2 products. An attacker with access to the console can modify the request URI to circumvent authentication and access restricted resources, leading to partial information disclosure. The known exposure is limited to memory statistics, but it allows unauthorized access to internal system details. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** Produtos WSO2 (versões afetadas não especificadas) **Descrição** Existe uma vulnerabilidade de execução remota de código (RCE) autenticada devido à validação inadequada de entrada no serviço administrativo do processador de eventos. Um atacante com acesso administrativo aos serviços administrativos SOAP pode implantar um plano de execução Siddhi contendo código Java malicioso, levando à execução arbitrária de código no servidor. A exploração requer uma conta de usuário válida com privilégios administrativos. O componente vulnerável é o serviço administrativo do processador de eventos, especificamente ao lidar com planos de execução Siddhi. O **endpoint da API** utilizado para implantação é o serviço administrativo SOAP. A vulnerabilidade reside na validação inadequada de entrada dentro do plano de execução Siddhi, permitindo que código Java malicioso seja injetado e executado. A variável `execution plan` dentro da requisição SOAP é suscetível a esta falha. A função `deployExecutionPlan()` está envolvida no processamento do plano de execução Siddhi. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.