WSO2 Privilege Escalation Vulnerability in SOAP Admin Services

A privilege escalation vulnerability has been identified in multiple WSO2 products, including WSO2 API Manager, WSO2 Identity Server, and WSO2 Open Banking solutions. This vulnerability arises from a business logic flaw in the SOAP admin services, allowing a malicious actor to create a new user with elevated permissions under certain conditions. Specifically, the SOAP admin services must be accessible to the attacker, the deployment must include a non-default internal attribute, at least one custom role with non-default permissions must exist, and the attacker must be aware of the custom role and the internal attribute used in the deployment. Exploitation of this vulnerability enables attackers to assign higher privileges to self-registered users, circumventing established access control mechanisms.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling self-registered users to gain elevated permissions.

Remediation

WSO2 users are advised to update to the latest version of the affected product. Commercial users with a support subscription should use the WSO2 Updates service to apply the fix.