CyberSecBulletin
CVE-2024-1524NVD status: Analyzed

WSO2 API Manager: Authentication Bypass by Spoofing

Published Updated By the CyberSecBulletin desk

CVE-2024-1524 is a high-severity authentication bypass by spoofing vulnerability in WSO2 API Manager from WSO2, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 4.2.0.108 as the first without the flaw, so updating WSO2 API Manager to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update WSO2 API Manager to 4.2.0.108 or a later version.
  2. Update WSO2 Identity Server to 6.0.0.171 or 6.1.0.128, whichever matches your release line, or a later version.
  3. Update API Manager to 4.2.0.108 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
WSO2WSO2 API Manager4.2.0 up to, but not including, 4.2.0.1084.2.0.108
WSO2WSO2 Identity Server6.0.0 up to, but not including, 6.0.0.171; 6.1.0 up to, but not including, 6.1.0.1286.0.0.171, 6.1.0.128
WSO2API Manager4.2.0 up to, but not including, 4.2.0.1084.2.0.108
WSO2Identity Server6.0.0 up to, but not including, 6.0.0.171; 6.1.0 up to, but not including, 6.1.0.1286.0.0.171, 6.1.0.128

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.7HighCNA
CVSS 3.18.1HighNVD

Official description

When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users. There will be no impact on your deployment if any of the preconditions mentioned below are not met. Only when all the preconditions mentioned below are fulfilled could a malicious actor associate a targeted local user account with a federated IDP user account that they control. The Deployment should have: -An IDP configured for federated authentication with Silent JIT provisioning enabled. The malicious actor should have: -A fresh valid user account in the federated IDP that has not been used earlier. -Knowledge of the username of a valid user in the local IDP. -An account at the federated IDP matching the targeted local username.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

More Authentication Bypass by Spoofing vulnerabilities (CWE-290)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

Other vulnerabilities in WSO2 API Manager

All WSO2 API Manager vulnerabilities

Recent Authentication Bypass by Spoofing vulnerabilities

Spotted an error? Tell us.