Plateforme
java
Composant
wso2-open-banking-am
Corrigé dans
4.5.0.34
4.6.0.1
4.5.0.34
4.6.0.1
4.5.0.36
4.6.0.1
3.1.0.349
3.2.0.453
3.2.1.73
4.0.0.373
4.1.0.236
4.2.0.176
4.3.0.88
4.4.0.52
4.5.0.35
4.6.0.1
5.10.0.378
5.11.0.425
6.0.0.252
6.1.0.253
7.0.0.130
7.1.0.38
7.2.0.1
5.10.0.369
6.6.0.226
4.5.3.50
4.6.0.2253
4.6.1.157
4.6.2.673
4.6.3.41
4.6.4.22
4.7.1.73
4.8.1.43
4.9.0.106
4.9.26.31
4.9.27.16
4.9.28.18
4.9.33.2
4.10.9.75
4.10.42.18
4.10.101.3
CVE-2025-6670 describes a Cross-Site Request Forgery (CSRF) vulnerability found in WSO2 Open Banking AM. This vulnerability allows an attacker to potentially manipulate an authenticated user's session and perform unauthorized actions within the admin services. The issue stems from the use of HTTP GET requests for state-changing operations, bypassing the effectiveness of the SameSite cookie attribute. Affected versions include those prior to 7.2.0.1, and a fix is available in version 7.2.0.1.
An attacker can exploit this CSRF vulnerability by crafting a malicious link and enticing an authenticated user to click it. Upon clicking, the user's browser will unknowingly send a request to the WSO2 Open Banking AM server, executing the attacker's intended action. This could involve modifying configurations, creating or deleting users, or performing other administrative tasks without the user's explicit consent. The potential impact is significant, as a successful exploit could lead to unauthorized access and control over the WSO2 Open Banking AM instance, potentially compromising sensitive data and disrupting services. The reliance on GET requests for state changes, despite the presence of SameSite cookies, is the root cause, making this a particularly concerning vulnerability.
CVE-2025-6670 was publicly disclosed on 2025-11-18. The vulnerability's reliance on GET requests for state changes, while employing SameSite cookies, presents a unique exploitation challenge. Currently, there are no publicly available proof-of-concept exploits, but the vulnerability's ease of exploitation makes it a potential target for opportunistic attackers. It is not currently listed on the CISA KEV catalog. The CVSS score of 8.8 (HIGH) reflects the potential for significant impact.
Organizations utilizing WSO2 Open Banking AM in production environments, particularly those with legacy configurations or shared hosting environments, are at risk. Environments where admin access is not adequately restricted or monitored are especially vulnerable. Any deployment relying on older, unpatched versions of WSO2 Open Banking AM is potentially exposed.
• linux / server: Monitor WSO2 Open Banking AM access logs for unusual GET requests to admin endpoints. Use journalctl to filter for errors related to authentication or authorization.
journalctl -u wso2am -f | grep "CSRF" • generic web: Use curl to test for CSRF vulnerabilities on admin endpoints. Check response headers for unexpected behavior after submitting a request.
curl -v -X GET 'https://wso2am/admin/endpoint?param=value' -b 'Cookie: SESSIONID=...' • java: Examine WSO2 Open Banking AM code for instances where GET requests are used for state-changing operations. Look for patterns where user input is directly used in the request without proper validation.
disclosure
Statut de l'Exploit
EPSS
0.04% (percentile 10%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2025-6670 is to upgrade WSO2 Open Banking AM to version 7.2.0.1 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds to reduce the attack surface. These may include restricting access to admin services to trusted networks, implementing stricter input validation on all admin endpoints, and carefully reviewing any third-party integrations that interact with the admin console. While SameSite cookies are present, their ineffectiveness in this scenario highlights the importance of using POST requests for state-changing operations. After upgrading, confirm the fix by attempting to trigger a CSRF attack and verifying that the request is blocked or ignored.
Mettez à jour vers la dernière version de WSO2 Open Banking AM qui contient la correction pour la vulnérabilité CSRF. Assurez-vous que les services de la console Carbon ne sont pas exposés à des réseaux non fiables, en suivant les WSO2 Secure Production Guidelines.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2025-6670 is a Cross-Site Request Forgery (CSRF) vulnerability in WSO2 Open Banking AM versions prior to 7.2.0.1, allowing attackers to perform unauthorized actions via crafted links.
Yes, if you are running WSO2 Open Banking AM versions earlier than 7.2.0.1, you are potentially affected by this CSRF vulnerability.
Upgrade WSO2 Open Banking AM to version 7.2.0.1 or later to resolve the vulnerability. Consider temporary workarounds if immediate upgrade is not possible.
While no public exploits are currently known, the vulnerability's ease of exploitation makes it a potential target for attackers.
Refer to the official WSO2 security advisory for detailed information and updates regarding CVE-2025-6670: [https://wso2.com/en/security/vulnerabilities/cve-2025-6670/](https://wso2.com/en/security/vulnerabilities/cve-2025-6670/)
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Téléverse ton fichier pom.xml et nous te dirons instantanément si tu es affecté.