Exécution de code arbitraire avec des utilisateurs privilégiés dans plusieurs produits WSO2 via les moteurs de médiateur de script (GraalJS et NashornJS)

The impact of CVE-2025-11093 is significant due to the potential for arbitrary code execution. An attacker who has successfully authenticated and obtained elevated privileges within WSO2 Micro Integrator can leverage this vulnerability to execute malicious code on the server. This could involve installing malware, stealing sensitive data, modifying system configurations, or establishing persistent access. The blast radius extends to any data processed by the integration runtime, and the attacker could potentially pivot to other systems within the network if the Micro Integrator instance has access to them. The vulnerability's reliance on authenticated access, while limiting initial exploitation, makes it particularly concerning in environments with compromised user accounts or weak privilege management.

Organizations utilizing WSO2 Micro Integrator for integration workflows, particularly those with complex privilege structures or legacy configurations, are at risk. Shared hosting environments where multiple users have administrative access to the WSO2 Micro Integrator instance are also particularly vulnerable.

• linux / server:

journalctl -u wso2mi -g "GraalJS" -g "NashornJS"

• generic web:

curl -I http://<wso2mi_host>/scripting/evaluate

• java / supply-chain: Check for unusual process executions related to GraalJS or NashornJS within the WSO2 Micro Integrator runtime environment. Monitor system logs for errors or warnings related to script execution.

1. 2025-11-05Disclosure

   disclosure

1. Réservé2025-09-27
2. Publiée2025-11-05
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-11093 is to upgrade WSO2 Micro Integrator to version 6.6.0.224 or later, which contains the fix. If immediate upgrading is not possible, consider restricting access to the GraalJS and NashornJS Script Mediator engines to only trusted administrators. Implement strict input validation and sanitization for any data passed to these scripting engines. Review user privileges and ensure the principle of least privilege is enforced. Monitor logs for suspicious activity related to script execution. After upgrading, confirm the fix by attempting to execute a known malicious script and verifying that it is blocked.