WSO2 Multiple Products JSON Web Token Authentication Bypass

critical Web App Scanning Plugin ID 115687

Language:

Synopsis

Description

WSO2 API Manager versions 4.1.0 to 4.6.0, WSO2 API Control Plane versions 4.5.0 and 4.6.0, WSO2 Traffic Manager versions 4.5.0 and 4.6.0 and WSO2 Universal Gateway versions 4.5.0 and 4.6.0 suffer from an authentication bypass vulnerability. The JSON Web Token signature validation used by the management REST APIs raises an error when a token is signed with an algorithm other than RSA, and the OAuth authentication interceptor discards this error instead of rejecting the request, which is then processed without any authentication nor scope validation. A remote and unauthenticated attacker can therefore forge a token carrying the Resident Key Manager issuer, signed with an unsupported algorithm such as HS256 and an arbitrary signature, to call the Admin and Publisher REST APIs, leading to the compromise of administrative accounts and to a full account takeover.

Solution

Apply the fixed update level (or later) according to the WSO2 advisory : WSO2 API Manager 4.1.0 update level 257, 4.2.0 update level 197, 4.3.0 update level 108, 4.4.0 update level 72, 4.5.0 update level 57, 4.6.0 update level 21, WSO2 API Control Plane 4.5.0 update level 58, 4.6.0 update level 22, WSO2 Traffic Manager 4.5.0 update level 56, 4.6.0 update level 21 and WSO2 Universal Gateway 4.5.0 update level 57, 4.6.0 update level 21. Open source users should apply the public fixes or migrate to the latest unaffected version.