WSO2 Products Server-Side Request Forgery Vulnerability in SOAP Admin Services

A server-side request forgery (SSRF) vulnerability has been identified in multiple WSO2 products, including WSO2 Identity Server, WSO2 Open Banking IAM, and WSO2 Open Banking KM. This vulnerability arises from inadequate input validation in SOAP admin services, allowing unauthenticated attackers to manipulate server-side requests. Exploitation could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected WSO2 product.

Impact

Exploitation of this vulnerability could result in unauthorized access to internal and external resources, including sensitive data and systems, reachable by the affected WSO2 product.

Remediation

Community users can apply the relevant fixes using the public pull request available on GitHub. Commercial users should update to the specified update level for their product version. WSO2 customers with a support subscription can use WSO2 Updates to apply the fix.