High Severity Unrestricted File Upload in WSO2 Products Enables Remote Code Execution (CVE‑2022‑29464)
What It Is
Multiple WSO2 middleware products (including Identity Server, API Manager, and Enterprise Integrator) contain an unrestricted file‑upload flaw. An attacker can upload a malicious payload to a vulnerable endpoint and achieve remote code execution on the underlying host.
Exploitability
The vulnerability is rated High (CVSS v3.1 ≈ 8.8). Public proof‑of‑concept code has been released, and the vendor has confirmed the issue. No confirmed large‑scale exploitation has been reported, but the ease of exploitation makes it a priority for remediation.
Affected Products
- WSO2 Identity Server
- WSO2 API Manager
- WSO2 Enterprise Integrator
- Other WSO2 platform components that accept file uploads
Why It Matters for Compliance & Audit Readiness
Unrestricted file upload bypasses core vendor‑management controls and undermines the integrity of your application stack. Demonstrating that you have identified, patched, and continuously monitor third‑party components is essential for a defensible audit trail under frameworks such as NIST CSF, ISO 27001, and PCI DSS. Evidence of timely patching and risk‑based vendor assessments supports continuous control assurance and reduces the likelihood of a control failure being cited during an audit.
Recommended Actions
- Inventory all WSO2 instances and map them to your vendor‑risk register.
- Apply the vendor‑released patches or upgrade to the latest supported version immediately.
- Restrict file‑upload endpoints: enforce whitelist of allowed MIME types, file size limits, and store uploads outside the web‑root.
- Enable runtime monitoring: log upload activity, trigger alerts on anomalous file types, and integrate with SIEM for real‑time detection.
- Document the remediation steps and update your control evidence repository to reflect the mitigated risk.
Source: CISA KEV – CVE‑2022‑29464