PT-2020-10448 · Wso2 · Wso2 Is As Key Manager+2

Sathish Kumar Balakrishnan · Published 2020-01-27 · Updated 2022-11-10 · CVE-2019-20437

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0

Description An issue was discovered where a custom claim dialect with an XSS payload, when configured in the identity provider basic claim configuration, gets executed if a user picks up that dialect's URI as the provisioning claim in the advanced claim configuration of the same Identity Provider. The attacker needs to have privileges to log in to the management console and to add and update identity provider configurations.

Recommendations For WSO2 API Manager version 2.6.0, consider disabling the custom claim dialect configuration until a patch is available. For WSO2 IS as Key Manager version 5.7.0, restrict access to the identity provider basic claim configuration to minimize the risk of exploitation. For WSO2 Identity Server version 5.8.0, avoid using the provisioning claim in the advanced claim configuration until the issue is resolved. As a temporary workaround, consider restricting privileges to log in to the management console and to add and update identity provider configurations.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20437

Affected Products

Wso2 Api Manager

Wso2 Is As Key Manager

Wso2 Identity Server

References · 6

• 🔥 https://github.com/cybersecurityworks/Disclosed/issues/20 · Exploit
• 🔥 https://cybersecurityworks.com/zerodays/cve-2019-20437-wso2.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-20437 · Vendor Advisory
• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20437 · Security Note
• https://t.me/cvenotify/498 · Telegram Post