WSO2 Identity Server Server-Side Template Injection Vulnerability Allowing Arbitrary Code Execution

A server-side template injection vulnerability has been identified in WSO2 Identity Server version 5.11.0. This issue arises from the use of a vulnerable third-party Velocity template engine, which allows a malicious actor with admin privileges to inject and execute arbitrary template syntax within server-side templates. Successful exploitation could lead to remote code execution, unauthorized access to sensitive information, or manipulation of data on the server.

Impact

Exploitation of this vulnerability could allow for arbitrary code execution on the server, with potential access to sensitive information or the ability to manipulate data.

Remediation

WSO2 Identity Server users should update to version 5.11.0 Update Level 433. Community users can migrate to the latest unaffected version. Support subscription holders can use WSO2 Updates to apply the fix.