/MAL-005

MAL-005: Zip Slip in Add Carbon Applications in WSO2 ESB

MAL-005: Zip Slip in Add Carbon Applications in WSO2 ESB

A ZIP file based directory traversal (Zip Slip) vulnerability was identified in the "Carbon Applications" add feature of WSO2 ESB. Remote code execution may be obtained by writing/overwriting specific files.

Why no CVE?

The vendor replied that this vulnerability was "Fixed in WUM" and no public disclosure was made.

Requirements:

This vulnerability requires:

  • Valid user credentials

Proof Of Concept:

More details and the exploitation process can be found in this PDF.