WSO2 Unrestricted File Upload and Remote Code Execution Vulnerability Analysis (CVE-2022-29464)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-29464) is a critical unrestricted file upload and directory traversal flaw in the file upload servlet of various WSO2 products. The internal /fileupload endpoint fails to properly validate file extensions and destination paths. Consequently, an attacker can manipulate the Content-Disposition header with directory traversal sequences (../../) to bypass the default temporary directory and write files directly into the web root (e.g., repository/deployment/server/webapps).

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker sends a multipart POST request to the vulnerable /fileupload endpoint. By embedding a directory traversal sequence in the filename parameter (e.g., ../../../../repository/deployment/server/webapps/sh.jsp), the attacker forces the WSO2 server to write an arbitrary JSP WebShell into a publicly accessible directory under the web root. Once uploaded, the attacker accesses the JSP file via a standard HTTP request, allowing them to execute arbitrary OS commands with the privileges of the WSO2 process.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability is actively exploited in the wild. Successful exploitation allows attackers to gain initial access, pivot within internal networks, exfiltrate sensitive database credentials, deploy ransomware, and compromise integrated Active Directory environments, posing an existential threat to enterprise infrastructure.