複数のWSO2製品における管理サービス内のHTTP GETによるCross-Site Request Forgery (CSRF)

An attacker can exploit this CSRF vulnerability by crafting a malicious link and enticing an authenticated user to click it. Upon clicking, the user's browser will unknowingly send a request to the WSO2 Open Banking AM server, executing the attacker's intended action. This could involve modifying configurations, creating or deleting users, or performing other administrative tasks without the user's explicit consent. The potential impact is significant, as a successful exploit could lead to unauthorized access and control over the WSO2 Open Banking AM instance, potentially compromising sensitive data and disrupting services. The reliance on GET requests for state changes, despite the presence of SameSite cookies, is the root cause, making this a particularly concerning vulnerability.

Organizations utilizing WSO2 Open Banking AM in production environments, particularly those with legacy configurations or shared hosting environments, are at risk. Environments where admin access is not adequately restricted or monitored are especially vulnerable. Any deployment relying on older, unpatched versions of WSO2 Open Banking AM is potentially exposed.

• linux / server: Monitor WSO2 Open Banking AM access logs for unusual GET requests to admin endpoints. Use journalctl to filter for errors related to authentication or authorization.

journalctl -u wso2am -f | grep "CSRF" 

• generic web: Use curl to test for CSRF vulnerabilities on admin endpoints. Check response headers for unexpected behavior after submitting a request.

curl -v -X GET 'https://wso2am/admin/endpoint?param=value' -b 'Cookie: SESSIONID=...' 

• java: Examine WSO2 Open Banking AM code for instances where GET requests are used for state-changing operations. Look for patterns where user input is directly used in the request without proper validation.

1. 2025-11-18Disclosure

   disclosure

1. 予約済み2025-06-25
2. 公開日2025-11-18
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-6670 is to upgrade WSO2 Open Banking AM to version 7.2.0.1 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds to reduce the attack surface. These may include restricting access to admin services to trusted networks, implementing stricter input validation on all admin endpoints, and carefully reviewing any third-party integrations that interact with the admin console. While SameSite cookies are present, their ineffectiveness in this scenario highlights the importance of using POST requests for state-changing operations. After upgrading, confirm the fix by attempting to trigger a CSRF attack and verifying that the request is blocked or ignored.