CVE-2022-29464: WSO2 API Manager RCE Vulnerability

CVE-2022-29464 Overview

CVE-2022-29464 is a critical unrestricted file upload vulnerability affecting multiple WSO2 products that enables remote code execution. The vulnerability allows unauthenticated attackers to exploit the /fileupload endpoint using a Content-Disposition header containing a directory traversal sequence to place malicious files under the web root directory, specifically targeting paths such as ../../../../repository/deployment/server/webapps. Successful exploitation grants attackers complete control over the affected server.

Critical Impact

This vulnerability is actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Unauthenticated remote attackers can achieve full system compromise through arbitrary file upload leading to remote code execution.

Affected Products

• WSO2 API Manager 2.2.0 up to 4.0.0
• WSO2 Identity Server 5.2.0 up to 5.11.0
• WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0
• WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0
• WSO2 Enterprise Integrator 6.2.0 up to 6.6.0
• WSO2 Open Banking AM 1.4.0 up to 2.0.0
• WSO2 Open Banking KM 1.4.0 up to 2.0.0
• WSO2 Open Banking IAM 2.0.0

Discovery Timeline

• 2022-04-18 - CVE-2022-29464 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2022-29464

Vulnerability Analysis

CVE-2022-29464 represents a severe security flaw in WSO2's file upload functionality. The vulnerability exists because the affected WSO2 products fail to properly validate and sanitize the Content-Disposition header in file upload requests sent to the /fileupload endpoint. This oversight allows attackers to craft malicious HTTP requests that bypass intended upload directory restrictions.

The attack requires no authentication, making it particularly dangerous for internet-exposed WSO2 deployments. Once exploited, attackers can upload web shells or other malicious payloads directly to executable directories within the web application context, leading to immediate remote code execution capabilities.

Root Cause

The root cause of this vulnerability is improper input validation (CWE-22: Path Traversal). The vulnerable WSO2 products do not adequately sanitize the filename parameter within the Content-Disposition header of multipart file upload requests. This allows directory traversal sequences such as ../ to escape the intended upload directory and write files to arbitrary locations within the server's file system that are accessible to the web server process.

Attack Vector

The attack vector is network-based and does not require any authentication or user interaction. An attacker can exploit this vulnerability by:

1. Sending a crafted HTTP POST request to the /fileupload endpoint on a vulnerable WSO2 instance
2. Including a malicious Content-Disposition header containing directory traversal sequences (e.g., ../../../../repository/deployment/server/webapps/shell.jsp)
3. The uploaded file, typically a JSP web shell, is written to the webapps directory
4. Accessing the uploaded web shell via a direct HTTP request to execute arbitrary commands on the server

The exploitation is straightforward and reliable, requiring only basic knowledge of HTTP request manipulation. Public proof-of-concept exploits are available, including a GitHub PoC for CVE-2022-29464 and documentation on Packet Storm.

Detection Methods for CVE-2022-29464

Indicators of Compromise

• Unexpected JSP, WAR, or other executable files appearing in repository/deployment/server/webapps/ directories
• HTTP POST requests to /fileupload endpoints containing ../ sequences in Content-Disposition headers
• Suspicious outbound network connections originating from WSO2 application processes
• New or modified files with recent timestamps in web-accessible directories

Detection Strategies

• Monitor HTTP access logs for POST requests to /fileupload endpoints with anomalous Content-Disposition headers
• Implement file integrity monitoring on WSO2 webapps and deployment directories
• Deploy web application firewall (WAF) rules to detect and block directory traversal patterns in HTTP headers
• Review process execution logs for unusual child processes spawned by the Java runtime hosting WSO2

Monitoring Recommendations

• Configure alerts for file creation events in WSO2's repository/deployment/server/webapps/ directory
• Implement network traffic analysis to identify suspicious POST requests with multipart form data to file upload endpoints
• Enable comprehensive logging on WSO2 instances and forward logs to a SIEM for correlation and alerting
• Monitor for CISA KEV-related threat intelligence feeds referencing CVE-2022-29464

How to Mitigate CVE-2022-29464

Immediate Actions Required

• Identify all WSO2 products in your environment and verify their version numbers against the affected versions list
• Isolate vulnerable WSO2 instances from the internet immediately if patching cannot be performed right away
• Apply the official security patches from WSO2 as documented in their security advisory
• Conduct forensic analysis on exposed systems to check for signs of prior compromise

Patch Information

WSO2 has released security patches to address this vulnerability. Organizations should consult the WSO2 Security Advisory 2021-1738 for detailed patching instructions specific to each affected product version. Given this vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, immediate patching is strongly recommended.

Workarounds

• Block external access to the /fileupload endpoint at the network perimeter using firewall rules or reverse proxy configurations
• Implement WAF rules to detect and block requests containing directory traversal sequences (../) in HTTP headers
• If the file upload functionality is not required, disable or remove the affected endpoints
• Apply network segmentation to limit the blast radius if a WSO2 instance is compromised

# Example: Block fileupload endpoint using Apache reverse proxy
# Add to Apache VirtualHost configuration
<Location "/fileupload">
    Order deny,allow
    Deny from all
    # Optionally allow from trusted internal networks only
    # Allow from 10.0.0.0/8
</Location>