WSO2 Products Arbitrary File Upload Vulnerability in SOAP Admin Services Allowing Remote Code Execution

A vulnerability allowing arbitrary file upload has been identified in multiple WSO2 products. This issue arises from inadequate validation of uploaded files and their destinations in SOAP admin services. A malicious actor with administrative privileges can exploit this vulnerability by uploading a specially crafted file to a user-controlled location within the deployment. Depending on how the uploaded file is handled, this could lead to remote code execution on the server. By default, only users with administrative access to the affected SOAP services can exploit this vulnerability.

Impact

Exploitation of this vulnerability could result in remote code execution on the server, depending on how the uploaded file is processed.