CVE-2024-7096
WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services
Impact
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.wso2.am:am-parent | >= 2.0.0, <= 4.3.0 | 4.4.0 |
| maven | org.wso2.is:identity-server-parent | >= 5.2.0, <= 7.0.0 | 7.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wso2 | Api Manager | Versions 2.0.0, 2.1.0, 2.2.0, 2.5.0, 2.6.0, 3.0.0 |
| Wso2 | Identity Server | Versions 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.5.0, 5.6.0 |
| Wso2 | Identity Server As Key Manager | Versions 5.3.0, 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0 |
| Wso2 | Open Banking Am | Versions 1.3.0, 1.4.0, 1.5.0, 2.0.0 |
| Wso2 | Open Banking Iam | Version 2.0.0 |
| Wso2 | Open Banking Km | Versions 1.3.0, 1.4.0, 1.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/
- https://github.com/advisories/GHSA-j63j-7r7r-5v4j
- https://nvd.nist.gov/vuln/detail/CVE-2024-7096
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573
- https://github.com/wso2/docs-security/blob/cfd53689909eef62fc5427e193e35e7df8ab1ef8/en/docs/security-announcements/security-advisories/2024/WSO2-2024-3573.md