# Better CVE-2022-29464

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. 

## Usage
python3 shell.jsp
Replace `` with the vulnerable server and `shell.jsp` with a filename you want to use for upload.<br><br>
Edit `shell.jsp` file as you want, but current shell works just fine too (better than other JSP shells, at least).<br>
This shell can harvest output from stdout and stderr. CMDs are ran using `/bin/sh`.

## Exposure
Mostly, sysadmins run WSO2 products as superuser. Using this exploit, you'll have **superuser permissions** over the whole system. 

Database files are located at ~/repository/database directory.
* username: **wso2carbon**
* password: **wso2carbon**
* DBMS: **H2 1.4.196**

You can use the IntelliJ IDEA to open H2 type databases, [like this.](

## Download files from the server

Using this exploit, you can copy any file from any directory to `~/repository/deployment/server/webapps/authenticationendpoint`. `authenticationendpoint` directory serves JSP, but can be used to serve other files too. 


cp ~/repository/database/WSO2CARBON_DB.h2.db ~/repository/deployment/server/webapps/authenticationendpoint/WSO2CARBON_DB.h2.db
This command will copy the main DB file to a directory we can use to download it from.

## Vulnerable products
* API Manager - 2.2.0 and above
* Identity Server - 5.2.0 and above (tested)
* Identity Server Analytics - 5.4.0, 5.4.1, 5.5.0, 5.6.0
* Identity Server as Key Manager - 5.3.0 and above
* Enterprise Integrator - 6.2.0 and above

## Disclaimer
I'm not responsible for any kind of thermonuclear war or you getting arrested. Use this exploit in a testing environment only.