WSO2 Products Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability allowing arbitrary file upload has been identified in multiple WSO2 products. This issue arises from inadequate validation of user input in SOAP admin services. A malicious actor with administrative privileges can exploit this vulnerability to upload files to a user-controlled location on the server. By doing so, the attacker could introduce a specially crafted payload that might lead to remote code execution on the server. The requirement for valid admin credentials restricts this vulnerability to authorized users who could act maliciously.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, with the potential for remote code execution on the affected server.