WSO2 Products Arbitrary Code Execution Vulnerability via Scripting Engines

A vulnerability allowing arbitrary code execution exists in multiple WSO2 products due to inadequate restrictions in the GraalJS and NashornJS Script Mediator engines. This issue affects authenticated users with elevated privileges, who can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is restricted to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator. However, in WSO2 API Manager, access is granted to both administrators and API creators. This vulnerability could enable trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution within the affected integration runtime environment.