CVE-2025-5350 Overview
CVE-2025-5350 is a combined Server-Side Request Forgery (SSRF) and Reflected Cross-Site Scripting (XSS) vulnerability affecting multiple WSO2 products. The flaw resides in the deprecated Try-It feature, which accepted user-supplied URLs without proper validation. An authenticated administrator can be tricked into visiting a crafted link that forces the server to fetch attacker-controlled content. That content is then reflected into the admin's browser context, enabling arbitrary JavaScript execution. The vulnerability is tracked under CWE-79 and documented in the WSO2 Security Advisory WSO2-2025-4124.
Critical Impact
An attacker can pivot administrator sessions to execute JavaScript in the admin UI and use SSRF to enumerate internal network services reachable from the WSO2 host.
Affected Products
- WSO2 API Manager versions 3.1.0 through 4.5.0
- WSO2 Identity Server versions 5.10.0 through 7.1.0, and Identity Server as Key Manager 5.10.0
- WSO2 Enterprise Integrator 6.6.0, Open Banking AM/IAM 2.0.0, API Control Plane 4.5.0, Traffic Manager 4.5.0, and Universal Gateway 4.5.0
Discovery Timeline
- 2025-10-24 - CVE-2025-5350 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5350
Vulnerability Analysis
The vulnerability exists in the deprecated Try-It feature that shipped with several WSO2 products. The feature accepts a URL parameter from an administrative user and issues a server-side HTTP request to that URL. The server returns the fetched response body directly in the HTTP response rendered by the admin's browser. This design combines two distinct weaknesses into a single request path.
First, the SSRF primitive allows a privileged user to force the WSO2 server to contact arbitrary internal or external endpoints. Because the request originates from the WSO2 host, it can reach services that would otherwise be unreachable from the attacker's network position. Second, the reflected response body executes in the admin's session context because no output encoding is applied. Session cookies carry the HttpOnly flag, which limits cookie theft, but the attacker can still perform arbitrary UI actions and exfiltrate data visible to the administrator.
Root Cause
The Try-It endpoint fails to validate the destination URL supplied by the user and fails to sanitize or content-type-restrict the fetched response before reflecting it into the HTTP response body. There is no allowlist for outbound targets and no output encoding on the returned content.
Attack Vector
Exploitation requires an authenticated administrator to be tricked into loading a crafted link, typically through phishing or a malicious page. The link points at the WSO2 Try-It endpoint with a URL parameter referencing an attacker-controlled server serving a payload such as an HTML document containing <script> tags. The WSO2 server fetches the payload and returns it in the response, causing the script to execute in the admin's browser under the WSO2 origin. The same primitive can be pointed at internal addresses such as http://127.0.0.1:9200/ or cloud metadata endpoints to enumerate reachable services.
No verified proof-of-concept code has been published. See the WSO2 Security Advisory for vendor-provided details.
Detection Methods for CVE-2025-5350
Indicators of Compromise
- Access log entries showing requests to Try-It endpoints containing external or internal URL parameters from administrative accounts.
- Outbound HTTP requests from the WSO2 server process to unexpected destinations, including RFC1918 ranges, localhost, or cloud metadata IPs such as 169.254.169.254.
- Administrator browser sessions performing unusual API calls or data exports shortly after visiting an external link.
Detection Strategies
- Inspect WSO2 carbon and HTTP access logs for invocations of Try-It handlers with attacker-controlled url or equivalent parameters.
- Correlate administrator authentication events with outbound network flows initiated by the WSO2 JVM process.
- Deploy web application firewall rules to alert on Try-It requests referencing off-host or private-range destinations.
Monitoring Recommendations
- Enable egress logging on the WSO2 host and forward events to a centralized analytics platform for anomaly review.
- Alert on any administrative UI activity following a browser navigation event to an external referrer.
- Track access patterns to the deprecated Try-It path and confirm the endpoint is disabled after remediation.
How to Mitigate CVE-2025-5350
Immediate Actions Required
- Apply the vendor-supplied WUM updates or upgrade to the fixed versions listed in WSO2 Security Advisory WSO2-2025-4124.
- Disable or remove the deprecated Try-It feature in affected deployments where it is not required.
- Restrict administrative console access to trusted networks and enforce phishing-resistant multi-factor authentication for admin accounts.
Patch Information
WSO2 has issued remediation guidance and updates through the vendor advisory. Customers on supported update channels should apply the associated WUM/U2 updates for their product version. Refer to the WSO2 Security Advisory WSO2-2025-4124 for the definitive fixed-version list and update instructions.
Workarounds
- Remove or comment out the Try-It handler configuration in the affected product's deployment descriptors to eliminate the vulnerable code path.
- Restrict outbound network access from the WSO2 host using host-based or network-level egress controls that block requests to internal service ranges and cloud metadata endpoints.
- Apply a reverse-proxy rule that blocks requests to Try-It URL paths until patching is complete.
# Example egress restriction using iptables to block metadata endpoint access
iptables -A OUTPUT -m owner --uid-owner wso2 -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner wso2 -d 127.0.0.0/8 ! -p tcp --dport 9443 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
