WSO2 API Manager 文件上传漏洞(CVE-2022-29464) 分析

WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.

1. Minimum memory - 2GB2. Processor - Pentium 800MHz or equivalent at minimum3. Java 1.8 or higher4. The Management Console requires you to enable Javascript of the Web browser, with MS IE 7. In addition to JavaScript, ActiveX should also be enabled with IE. This can be achieved by setting your security level to medium or lower.5. Apache Ant is required to compile and run the sample clients. Apache Ant 1.7.0 version is recommended.6. To build WSO2 API Manager from the source distribution, it is necessary that you have JDK 1.8 and Maven 3.0.4 or later.

execute:39, ToolsAnyFileUploadExecutor (org.wso2.carbon.ui.transports.fileupload)executeGeneric:104, AbstractFileUploadExecutor (org.wso2.carbon.ui.transports.fileupload)execute:436, FileUploadExecutorManager$CarbonXmlFileUploadExecHandler (org.wso2.carbon.ui.transports.fileupload)startExec:320, FileUploadExecutorManager$FileUploadExecutionHandlerManager (org.wso2.carbon.ui.transports.fileupload)execute:127, FileUploadExecutorManager (org.wso2.carbon.ui.transports.fileupload)doPost:57, FileUploadServlet (org.wso2.carbon.ui.transports)service:660, HttpServlet (javax.servlet.http)service:741, HttpServlet (javax.servlet.http)service:37, ContextPathServletAdaptor (org.eclipse.equinox.http.helper)service:61, ServletRegistration (org.eclipse.equinox.http.servlet.internal)processAlias:128, ProxyServlet (org.eclipse.equinox.http.servlet.internal)service:68, ProxyServlet (org.eclipse.equinox.http.servlet.internal)service:741, HttpServlet (javax.servlet.http)service:68, DelegationServlet (org.wso2.carbon.tomcat.ext.servlet)internalDoFilter:231, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:53, WsFilter (org.apache.tomcat.websocket.server)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:72, CsrfGuardFilter (org.owasp.csrfguard)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:65, CharacterSetFilter (org.wso2.carbon.tomcat.ext.filter)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:126, HttpHeaderSecurityFilter (org.apache.catalina.filters)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)invoke:202, StandardWrapperValve (org.apache.catalina.core)invoke:96, StandardContextValve (org.apache.catalina.core)invoke:541, AuthenticatorBase (org.apache.catalina.authenticator)invoke:139, StandardHostValve (org.apache.catalina.core)invoke:92, ErrorReportValve (org.apache.catalina.valves)invoke:107, TenantContextRewriteValve (org.wso2.carbon.identity.context.rewrite.valve)invoke:110, AuthorizationValve (org.wso2.carbon.identity.authz.valve)invoke:102, AuthenticationValve (org.wso2.carbon.identity.auth.valve)continueInvocation:101, CompositeValve (org.wso2.carbon.tomcat.ext.valves)invokeValves:49, TomcatValveContainer (org.wso2.carbon.tomcat.ext.valves)invoke:62, CompositeValve (org.wso2.carbon.tomcat.ext.valves)invoke:145, CarbonStuckThreadDetectionValve (org.wso2.carbon.tomcat.ext.valves)invoke:690, AbstractAccessLogValve (org.apache.catalina.valves)invoke:57, CarbonContextCreatorValve (org.wso2.carbon.tomcat.ext.valves)invoke:126, RequestCorrelationIdValve (org.wso2.carbon.tomcat.ext.valves)invoke:74, StandardEngineValve (org.apache.catalina.core)service:343, CoyoteAdapter (org.apache.catalina.connector)service:373, Http11Processor (org.apache.coyote.http11)process:65, AbstractProcessorLight (org.apache.coyote)process:868, AbstractProtocol$ConnectionHandler (org.apache.coyote)doRun:1590, NioEndpoint$SocketProcessor (org.apache.tomcat.util.net)run:49, SocketProcessorBase (org.apache.tomcat.util.net)runWorker:-1, ThreadPoolExecutor (java.util.concurrent)run:-1, ThreadPoolExecutor$Worker (java.util.concurrent)run:61, TaskThread$WrappingRunnable (org.apache.tomcat.util.threads)run:-1, Thread (java.lang)