Securin Zero-Days
CVE-2019-20442 - Stored Cross-Site Scripting in WSO2
Description
An issue was discovered on WSO2 API Manager before 5.7.0 in the registry UI. A stored cross-site script (XSS) vulnerability allows an attacker to inject malicious code into the application and stored in the server. An input variable was vulnerable to stored XSS is ‘roleToAuthorize’ on the browser page.
*Affected Products: WSO2 API Manager, WSO2 API Manager Analytics, WSO2 IS as Key Manager, WSO2 IS as Key Manager, WSO2 Identity Server, WSO2 Identity Server Analytics
Proof of Concept (POC):
The following vulnerability was tested on WSO2 Identity Server version 5.7.0 Product.
Issue 01: Stored Cross-Site Scripting
Figure 01: Choose “Browse” from the Registry option.
Figure 02: Select any on ‘Role’ and add “Permission” from the permission section on the same page.
Figure 03: Capture the POST request in burp suite proxy and add XSS payload, “><img src=x onerror=prompt(1)> to “roleToAuthorize” variable.
Figure 04: Injected XSS Payload gets stored and executed in the browser.
Figure 05: The stored XSS payload gets executed whenever the user loads the page
Impact
Through an XSS attack, the attacker can make the browser redirect to a malicious website. Unauthorized actions such as changing the UI of the web page, retrieving information from the browser are possible. But since all session-related sensitive cookies are set with httponly flat and protected, session hijacking or mounting a similar attack would not be possible.
Remediations
Download the following patch based on your product version.
Code | Product | Version | Patch |
APIM | WSO2 API Manager | 2.6.0 | |
EI | WSO2 Enterprise Integrator | 6.5.0 | |
IS KM | WSO2 IS as Key Manager | 5.7.0 | |
IS | WSO2 Identity Server | 5.8.0 |
Timeline
