Security Advisory WSO2-2017-0183

Published: 6th March 2017

AFFECTED PRODUCTS

WSO2 Application Server 5.3.0

WSO2 Data Services Server 3.5.1

WSO2 Enterprise Service Bus 5.0.0

WSO2 Message Broker 3.1.0

OVERVIEW

The WSO2 Carbon WSDL Tool of above listed products has been identified to have XSS vulnerability where a user can inject an executable script as a user input.

DESCRIPTION

In Carbon WSDL Tool, reflected XSS attack can be performed when a user injects a malicious executable script as user input through carbon management console.

This issue has been fixed in affected component with the security patches given for specific products.

 IMPACT

An attacker can include malicious content in a request to Carbon WSDL Tool’s wsdl2code page in management console, and trick a user to click the malicious content via email or a neutral web site. This reflects the attack back to the user’s browser and will execute the injected code, which may generate malicious page results that will mislead the victim or harm otherwise.

SOLUTION

The recommended solution is to apply relevant security patches which fix the XSS vulnerability identified in the specific components used in products.

Please see below for details on patching or updating the affected component.

For WSO2 Update Manager (WUM) Supported Products

Please use WUM to update the following products.

For Other Products

Apply the following patches based on your product version by following the instructions in the README file. If you have any questions, post them to security@wso2.com.

Please download the relevant patches based on the products you use following the matrix below. Patches can also be downloaded from http://wso2.com/security-patch-releases/.

NOTES

If you are using newer versions of the products than the ones mentioned in the “SOLUTION” section, this vulnerability is fixed. 

CREDITS

WSO2 thanks, Marcin Woloszyn for responsibly reporting the identified issues and working with us as we addressed them.