WSO2 API Manager 中通过身份验证终端点进行的反射型跨站脚本攻击允许修改 UI 和重定向

WSO2 API Manager 中的 CVE-2024-10242 漏洞源于认证端点对用户输入验证不足。这使得攻击者可以将恶意脚本负载注入到输入参数中，并在受害者的浏览器中执行这些参数。虽然成功利用可能允许攻击者将用户的浏览器重定向到恶意网站、修改网页的 UI 或从浏览器中检索信息，但影响有限，因为与会话相关的敏感 Cookie 未直接泄露。CVSS 分数为 6.1，表示中等风险。强烈建议升级到 4.0.0.318 版本以降低此风险。

Organizations utilizing WSO2 API Manager for managing and securing APIs, particularly those running versions 0.0.0 through 4.0.0.318, are at risk. This includes companies relying on WSO2 API Manager for authentication and authorization processes, and those with custom integrations that interact with the authentication endpoint.

• javascript: Examine the WSO2 API Manager authentication endpoint for unusual JavaScript behavior or unexpected redirects. Use browser developer tools to inspect network requests and responses for injected scripts. • generic web: Monitor access and error logs for suspicious patterns indicative of XSS attempts, such as unusual characters or script tags in authentication requests. • generic web: Check response headers for Content-Security-Policy (CSP) directives. A properly configured CSP can significantly reduce the impact of XSS vulnerabilities.

1. 2026-04-16Disclosure

   disclosure

1. 已保留2024-10-22
2. 发布日期2026-04-16
3. EPSS 更新日期2026-04-23

CVE-2024-10242 的解决方案是将 WSO2 API Manager 升级到 4.0.0.318 或更高版本。此版本包含必要的修复程序，以正确验证用户输入并防止脚本注入。作为临时缓解措施，建议实施内容安全策略 (CSP)，以限制浏览器中可以执行的脚本来源。定期监控服务器日志中与认证端点相关的可疑活动也很重要。升级是完全消除此漏洞的最有效和推荐的解决方案。