Horizon Alert
Summary of the vulnerability and why it matters
WSO2 products can be tricked into revealing sensitive files or system information. This happens because their XML processors allow attackers to provide specially crafted data that causes the system to fetch unwanted content. This could lead to significant data exposure or service disruption.
- Attackers can read local files.
- Services can be disrupted.
- Attackers don't need prior access.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by sending specially crafted XML payloads to vulnerable WSO2 products. This allows them to read sensitive files from the server's file system or access other HTTP resources the product can reach. It can also be used to disrupt services by overwhelming the server with large external resource requests.
- Malicious XML payload required.
- No authentication needed.
- Network access to the product.
Live Threat
Current exploitation, exposure, and threat context
Attackers will likely target this vulnerability because it allows for remote file access, information disclosure, and denial-of-service attacks on widely deployed WSO2 products. The ease of crafting malicious XML payloads and the critical impact of successful exploitation make it an attractive target for adversaries seeking to compromise sensitive data or disrupt services.
- Public exploits are not yet available.
- No KEV signal observed.
- No recent exploitation activity is evident.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating or taking offline WSO2 products with vulnerable XML parsers due to the risk of sensitive data exposure and denial of service. Investigate logs for signs of external entity processing or large recursive entity expansions.
- Block external XML entity resolution.
- Update WSO2 products to patched versions.
- Monitor for unauthorized file access.
