WSO2 API Manager 中通过开发者门户进行的跨站脚本攻击允许修改 UI 和检索信息

WSO2 API Manager 的 CVE-2024-4867 影响开发者门户，由于用户输入验证不足和输出编码不当，允许恶意脚本注入。攻击者可以在用户的浏览器中注入 JavaScript 代码，从而危及应用程序的安全性和完整性。这可能导致用户被重定向到恶意网站、UI 操作或从浏览器中检索敏感信息（例如会话 Cookie）。根据 CVSS，此漏洞的严重程度评分为 5.4，不被认为是关键漏洞 (KEV)。

Organizations utilizing WSO2 API Manager for API management, particularly those relying on the developer portal for API documentation and testing, are at risk. Environments with legacy configurations or those that have not implemented robust input validation practices are especially vulnerable. Shared hosting environments where multiple API Manager instances share resources could also experience broader impact.

• generic web: Use curl or wget to test developer portal endpoints for XSS vulnerabilities. Examine response headers for unexpected content. • generic web: Search access and error logs for suspicious JavaScript code or unusual redirects originating from user input fields. • javascript: Inspect the WSO2 API Manager developer portal's JavaScript code for any instances where user input is directly rendered without proper sanitization. • javascript: Use browser developer tools to monitor network requests and identify any unexpected redirects or script injections.

1. 2026-04-16Disclosure

   disclosure

1. 已保留2024-05-14
2. 发布日期2026-04-16
3. EPSS 更新日期2026-04-23

为了减轻与 CVE-2024-4867 相关的风险，我们强烈建议将 WSO2 API Manager 升级到 4.1.0.187 或更高版本。此版本包含必要的修复程序，以解决跨站点脚本 (XSS) 漏洞。在执行升级时，可以实施额外的安全措施，例如在开发者门户中对所有用户输入进行严格验证以及对输出进行适当编码，以防止恶意脚本执行。此外，建议监控应用程序日志以查找可疑活动。