CVE-2024-4457

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations.

In WSO2 products, when internal roles are removed from a user, the system fails to invalidate previously issued authentication tokens. Users may retain access privileges even after role revocation.

The Class Mediator in WSO2 products fails to properly validate or sanitize messageContext properties used for dynamic values. Authenticated users may access or modify data across invocations.

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties without sufficient validation or sanitization. An attacker with access to 'wso2carbon' log files could retrieve sensitive information, such as credentials, potentially leading to unauthorized access.

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This can lead to exposure of personally identifiable information of users in different tenants.

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This can lead to associating a subject with an unintended local account if the same lookup claim exists in both stores.

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim's browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.

Multiple WSO2 products with Multi-Attribute Login enabled are vulnerable to username enumeration. The system returns a distinct "User does not exist" error message regardless of the validate_username setting, allowing attackers to identify existing accounts. This can aid brute-force attacks, phishing, and social engineering.