## https://sploitus.com/exploit?id=BA1B8A32-DE69-5E8F-BE8B-23C0A4E48A03
# Better CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory.
<br><br>
## Usage
```
python3 main.py https://example.com shell.jsp
```
Replace `https://example.com` with the vulnerable server and `shell.jsp` with a filename you want to use for upload.<br><br>
Edit `shell.jsp` file as you want, but current shell works just fine too (better than other JSP shells, at least).<br>
This shell can harvest output from stdout and stderr. CMDs are ran using `/bin/sh`.
## Exposure
Mostly, sysadmins run WSO2 products as superuser. Using this exploit, you'll have **superuser permissions** over the whole system.
Database files are located at ~/repository/database directory.
* username: **wso2carbon**
* password: **wso2carbon**
* DBMS: **H2 1.4.196**
You can use the IntelliJ IDEA to open H2 type databases, [like this.](https://medium.com/@smartsplash/accessing-the-h2-database-for-wso2-products-c5d44b2f5590)
## Download files from the server
Using this exploit, you can copy any file from any directory to `~/repository/deployment/server/webapps/authenticationendpoint`. `authenticationendpoint` directory serves JSP, but can be used to serve other files too.
Example:
```
cp ~/repository/database/WSO2CARBON_DB.h2.db ~/repository/deployment/server/webapps/authenticationendpoint/WSO2CARBON_DB.h2.db
```
This command will copy the main DB file to a directory we can use to download it from.
## Vulnerable products
* API Manager - 2.2.0 and above
* Identity Server - 5.2.0 and above (tested)
* Identity Server Analytics - 5.4.0, 5.4.1, 5.5.0, 5.6.0
* Identity Server as Key Manager - 5.3.0 and above
* Enterprise Integrator - 6.2.0 and above
## Disclaimer
I'm not responsible for any kind of thermonuclear war or you getting arrested. Use this exploit in a testing environment only.