CVE-2022-29464

This vulnerability is like a “back door upload” flaw: if your WSO2 server is reachable, an attacker can trick it into accepting a malicious file and placing it in a location where the server can run it as code. In plain terms, it can turn your server into something the attacker controls—often leading to ransomware or long-term compromise.

This matters if your small business runs any of these WSO2 products: WSO2 API Manager, WSO2 Enterprise Integrator, WSO2 Identity Server, WSO2 Identity Server Analytics, WSO2 Identity Server as Key Manager, or WSO2 Open Banking AM/KM, and your installed version is in the vulnerable ranges.

This is only a risk if an attacker can reach the affected /fileupload endpoint over the network (no login and no user action required) and uses the specific request pattern described in the advisory (Content-Disposition traversal).

This is a RED issue because attackers have used it in real-world ransomware campaigns and it’s been confirmed in CISA KEV. It requires no authentication and no user interaction, and it’s reachable in default configuration when the vulnerable /fileupload endpoint is exposed.

Act now to patch to the fixed versions called out by WSO2 and remove external reachability to the upload endpoint until patched.

1. Confirm exposure and product/version

   • Identify which affected WSO2 product you run (API Manager, Enterprise Integrator, Identity Server, Identity Server Analytics, Identity Server as Key Manager, Open Banking AM, Open Banking KM).
   • Record your exact version.
   • Vulnerable version ranges (as reported for CVE-2022-29464):
     • WSO2 API Manager: 2.2.0 up to 4.0.0
     • WSO2 Identity Server: 5.2.0 up to 5.11.0
     • WSO2 Identity Server Analytics: 5.4.0, 5.4.1, 5.5.0, 5.6.0
     • WSO2 Identity Server as Key Manager: 5.3.0 up to 5.11.0
     • WSO2 Enterprise Integrator: 6.2.0 up to 6.6.0
     • WSO2 Open Banking AM: 1.4.0 up to 2.0.0
     • WSO2 Open Banking KM: 1.4.0 up to 2.0.0

2. Check reachability of the vulnerable endpoint

   • Determine whether the /fileupload endpoint on the deployed service is reachable from the internet (publicly accessible). This vulnerability has “no authentication required” and “no user interaction,” so internet reachability materially increases risk.

3. Patch using the vendor-fixed versions

   • Follow the WSO2 remediation instructions in the advisory for WSO2-2021-1738:
     • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/
   • Upgrade to the fixed release versions specified in that advisory for your exact product and version branch.

4. Temporary containment if patching is delayed

   • Block or restrict network access so /fileupload is not reachable from the internet.
   • If you use a reverse proxy/WAF, add strict rules to deny requests to the /fileupload path on the affected service until the upgrade is complete.

5. Confirm remediation

   • After upgrading, re-verify your server version matches the patched guidance from the WSO2 advisory.
   • Optionally verify that /fileupload is not reachable externally (or is otherwise tightly controlled).

6. Timing note from CISA KEV

   • CISA listed this vulnerability in KEV with a remediation due date of 2022-05-16.

7. What to monitor

   • Monitor for signs of webshell or unexpected file creation under your web server root and for unusual process execution shortly after any external connection to the WSO2 service.

Severity and posture: This is critical (CVSS 9.8) and rated RED here due to confirmed real-world abuse (CISA KEV listing for ransomware campaigns).

Mechanism/weakness: CWE-22. An attacker can exploit a directory traversal issue in how WSO2 handles uploads via the /fileupload endpoint. By crafting a request that uses a Content-Disposition directory traversal sequence, the attacker can upload malicious content into directories under the web server root, enabling remote code execution.

Authentication/interaction: None required (unauthenticated), and no user interaction is needed.

Attack vector: Network-based; preconditions include access to an exposed /fileupload endpoint.

Exploit maturity: Public PoC exists, and the vulnerability has been weaponized; CISA KEV confirms exploitation in the wild.

KEV meaning: “CISA KEV” indicates vulnerabilities that CISA has identified as being exploited in the real world, which is why this is treated as urgent.

EPSS: Provided as a prediction with a very high percentile and rising trend, but KEV-confirmed exploitation drives the urgency regardless of prediction.