Unauthenticated File Upload RCE in WSO2 Products

This repository is a small standalone Python exploit loader for CVE-2022-29464 targeting vulnerable WSO2 servers. It contains only two files: a README with usage instructions and main.py, which implements the exploit logic. The script reads a list of target hosts from a user-supplied file, then spawns a thread per host to attack them concurrently. The exploit workflow is straightforward: for each host, it generates a random JSP filename, builds an embedded JSP web shell, and uploads it to the target using a POST request to /fileupload/toolsAny. The uploaded multipart form field name is crafted as a path traversal string pointing to ../../../../repository/deployment/server/webapps/authenticationendpoint/{filename}, which attempts to write the JSP into a web-accessible directory. After waiting 15 seconds, the script sends a GET request to /authenticationendpoint/{filename} to trigger the shell. The JSP payload provides remote command execution by reading a request parameter named cmd and passing it to Runtime.getRuntime().exec(). It captures stdout and returns the output in the HTTP response. The Python script reports success only by checking for HTTP 200 from the shell URL; it does not robustly validate command output. Notably, the trigger request is coded as ?={params['command']} instead of ?cmd=..., which appears to be a bug and may prevent command execution unless manually corrected or tolerated by the environment. Overall, this is a real exploit rather than a detector. It is operational but basic: it weaponizes the WSO2 arbitrary file upload/path traversal issue into JSP web shell deployment and bulk target execution, with hardcoded behavior and minimal error handling.

Repository purpose: a small Python3 exploit tool (“WSOB”) targeting CVE-2022-29464 (WSO2 unrestricted file upload leading to RCE). Structure and key files: - main.py: CLI entry point. Requires -u (target base URL). Prints banner then calls start(). - src/interface/ui.py + src/interface/banner.txt: renders an ASCII banner using rich. - src/wsob/helpers/settings.py: builds requests options (props) including random User-Agent (from src/wsob/helpers/user-agents.txt), keep-alive, allow_redirects=True, and verify=False (TLS cert validation disabled). - src/wsob/main.py: core logic. - start(): sends an HTTP GET to the provided base URL to check reachability; proceeds only if response.ok. - exploit(): performs the actual exploit by POSTing to /fileupload/toolsAny with a multipart file whose name includes a directory traversal path to write a JSP into WSO2’s webapps directory. Exploit capability: - Achieves remote code execution by uploading a JSP webshell to: ../../../../repository/deployment/server/webapps/authenticationendpoint/authendpoint.jsp - After upload, it reports the webshell URL: /authenticationendpoint/authendpoint.jsp which executes arbitrary OS commands supplied via the 'cmd' request parameter. Notes: - The tool is operational but basic: it hardcodes the webshell and destination path and only checks success via HTTP status code == 200 on upload.

Repository purpose: a simple multi-target “loader” exploit for CVE-2022-29464 against WSO2 servers. Structure: - README.md: basic usage instructions (install colored; run `python3 main.py <vuln-list> <command>`). - main.py: the exploit implementation. How it works (main.py): - Reads a list of target base URLs/hosts from a user-supplied file (one per line). - Spawns a thread per target and runs Exploit.exploit(). - Generates a random JSP filename and builds a JSP webshell payload that executes `request.getParameter("cmd")` via `Runtime.getRuntime().exec()` and returns stdout. - Sends a POST request to `{host}/fileupload/toolsAny` with a crafted multipart `files` key containing a directory traversal path: `../../../../repository/deployment/server/webapps/authenticationendpoint/<random>.jsp`. This attempts to write the JSP into the WSO2 `authenticationendpoint` webapp directory. - Waits 15 seconds, then requests `{host}/authenticationendpoint/<random>.jsp` to trigger execution (the code appends `?={command}` but the JSP expects `cmd=...`, so as written the trigger parameter appears buggy and may not execute the intended command unless adjusted). Capabilities: - Arbitrary file write (JSP) into a web-accessible directory via vulnerable upload endpoint. - Intended remote command execution through the dropped JSP webshell. - Basic concurrency for scanning/exploitation of multiple hosts. Notable implementation details: - TLS verification is disabled (verify=False) and urllib3 warnings are suppressed. - Success is determined only by HTTP 200 on the JSP request; no parsing of output. - No cleanup/removal of the uploaded JSP.

This repository contains an operational exploit for CVE-2022-29464, a critical vulnerability in WSO2 products that allows unauthenticated file upload and remote code execution. The main file, 'main.py', is a Python script that automates exploitation against a list of vulnerable servers. It reads a file containing target URLs, then for each target, uploads a randomly-named JSP web shell to the '/fileupload/toolsAny' endpoint using a crafted POST request. After a short delay, it accesses the uploaded shell at '/authenticationendpoint/<random>.jsp', passing a command to execute via the HTTP request. The shell executes the command on the server and returns the output. The exploit is multi-threaded, allowing concurrent attacks on multiple targets. The repository also includes a README.md with usage instructions. No hardcoded IPs or domains are present; the targets are supplied by the user. The exploit is not part of a framework and is a standalone operational tool.

This repository is a Python-based exploit tool targeting CVE-2022-29464, a critical unrestricted file upload vulnerability in multiple WSO2 products. The exploit works by sending a crafted HTTP POST request to the /fileupload/toolsAny endpoint, abusing directory traversal to upload a JSP webshell to the server's web root. If successful, the webshell is accessible at /authenticationendpoint/authendpoint.jsp, allowing the attacker to execute arbitrary commands on the server via a web interface. The repository is structured with a main entry point (main.py), supporting modules for UI and HTTP request configuration, and a hardcoded JSP webshell payload. The tool requires Python 3 and the 'requests' and 'rich' libraries. It is operational and provides a working exploit with a functional payload, but is not part of a larger exploitation framework.

This repository is a mass exploitation toolkit targeting WSO2 Carbon Server instances vulnerable to CVE-2022-29464 (pre-auth RCE). The main components are a Python exploit script (exploit.py) and a Bash automation script (mass_exploit.sh). The Bash script automates the process of searching for vulnerable hosts using Shodan and Zoomeye, then invokes the Python script to exploit each target. The Python script uploads a JSP web shell and a JSP reverse shell to the target server via a vulnerable file upload endpoint. The web shell allows arbitrary command execution via HTTP, while the reverse shell connects back to a hardcoded ngrok address. The toolkit is operational and can be used for mass exploitation, provided the attacker has access to Shodan/Zoomeye API keys and a list of targets. The repository also includes example dorks and result files for host enumeration. The exploit is not part of a framework and is standalone.

This repository provides a working exploit for CVE-2022-29464, an unauthenticated file upload vulnerability affecting several WSO2 products. The main script, 'CVE-2022-29464.py', is a Python tool that automates the exploitation process. It allows the user to specify a single target or a list of targets (host:port format) and uploads a user-specified JSP file (by default, 'uploader.jsp') to the vulnerable server via the '/fileupload/toolsAny' endpoint. The script then verifies if the upload was successful by attempting to access the uploaded file at '/authenticationendpoint/<filename>'. The included 'uploader.jsp' is a JSP webshell that allows further file uploads to the server, while the default payload in the script is a simple command execution webshell. The repository also contains a README with usage instructions, a requirements.txt for dependencies, and a sample 'targets.txt' file. The exploit is operational and provides remote code execution capabilities if the target is vulnerable. No detection-only scripts are present; the code is a real exploit. The attack vector is network-based, requiring access to the target's HTTP(S) interface.

This repository provides a working exploit for CVE-2022-29464, a critical remote code execution vulnerability affecting several WSO2 products. The exploit is implemented in Python (run.py) and allows an attacker to upload arbitrary files to the target server via the vulnerable /fileupload/toolsAny endpoint. The main payload is a JSP webshell, which is uploaded to the authenticationendpoint directory, enabling the attacker to execute arbitrary system commands via a web interface. The exploit can target a single URL or multiple targets listed in a file. The README.md provides detailed usage instructions and lists all affected WSO2 product versions. The repository is structured with a single exploit script (run.py), a README, and a license file. The exploit is operational and provides a real, interactive shell on the target if successful.

This repository contains an exploit for CVE-2022-29464, a critical unauthenticated arbitrary file upload vulnerability in WSO2 products. The exploit consists of a Python script (exploit.py) and a detailed README.md writeup. The exploit works by uploading a malicious JSP web shell to the /fileupload/toolsAny endpoint, exploiting a path traversal to place the shell in the authenticationendpoint web application directory. Once uploaded, the shell can be accessed via the /authenticationendpoint/{file} URL, allowing the attacker to execute arbitrary commands on the server. The repository is well-documented, with the README providing technical background, PoC instructions, and screenshots. The exploit is operational, providing a working web shell payload, and targets WSO2 products vulnerable to CVE-2022-29464.

This repository contains two Python exploit scripts (exploit.py and exploit-v2.py) targeting the WSO2 Carbon Server vulnerability CVE-2022-29464, which allows unauthenticated remote code execution via a file upload flaw. Both scripts automate the exploitation process by uploading a JSP web shell and a JSP reverse shell to the target server using the /fileupload/toolsAny endpoint. The web shell allows arbitrary command execution via HTTP requests, while the reverse shell attempts to connect back to a hardcoded ngrok address (8.tcp.ngrok.io:12508), granting the attacker an interactive shell. The scripts support both single-target and batch exploitation (via a file of URLs). The repository also includes dork files (shodan-dork.txt, zoomeye-dork.txt) to help identify vulnerable WSO2 Carbon Server instances exposed on the internet. The exploit is operational, with hardcoded payloads and a fixed reverse shell address, and is not part of a larger exploitation framework.

This repository contains a Python exploit for CVE-2022-29464, a remote code execution vulnerability in WSO2 products. The exploit consists of a single main script (exploit.py) and a README.md with usage instructions. The exploit.py script allows the user to target multiple hosts by providing a file with URLs. It attempts to upload a JSP webshell to the vulnerable /fileupload/toolsAny endpoint using a path traversal technique, placing the shell at '../../../../repository/deployment/server/webapps/authenticationendpoint/megas.jsp'. After uploading, it accesses the shell at '/authenticationendpoint/megas.jsp' and executes a test command ('id') to verify successful exploitation. The script supports multithreading for efficiency and can save results to an output file. The main capability is remote code execution via a webshell, and the exploit is operational with a hardcoded payload. No framework is used; the code is standalone.

This repository is an operational exploit for CVE-2022-29464, a critical file upload vulnerability in WSO2 Identity Server (and related WSO2 Carbon Servers). The exploit consists of a Python script (wso.py) that automates the process of uploading a malicious JSP web shell (Files/shell.jsp) to a vulnerable server via the /fileupload/toolsAny endpoint. The web shell provides a comprehensive web-based interface for file management and arbitrary command execution on the compromised server. The exploit supports both single-target and mass exploitation modes, and stores successful shell URLs in a results file. The repository includes a README with usage instructions, requirements, and background on the vulnerability. The main attack vector is network-based, targeting exposed WSO2 servers. The endpoints of interest are the vulnerable upload endpoint and the location where the shell is deployed and accessed. The payload is a feature-rich JSP web shell, granting the attacker full control over the server's filesystem and command execution.

This repository contains a Python exploit script (exploit.py) targeting WSO2 servers vulnerable to CVE-2022-29464, an arbitrary file upload vulnerability. The exploit uploads a JSP webshell to the authenticationendpoint webapp directory via the /fileupload/toolsAny endpoint, allowing remote command execution through a web interface. The repository is minimal, with only four files: a .gitignore, LICENSE, README.md, and the main exploit script. The README provides a usage example, and the exploit.py script is self-contained, requiring only the target URL and desired shell filename as arguments. The payload is a JSP webshell that enables arbitrary command execution on the compromised server. The exploit is operational and demonstrates a real-world attack scenario against vulnerable WSO2 deployments.

This repository provides a working exploit for CVE-2022-29464, an unrestricted file upload vulnerability in multiple WSO2 products. The exploit consists of a Python script (main.py) that uploads a JSP web shell (shell.jsp) to a vulnerable server via the /fileupload/toolsAny endpoint, using a directory traversal payload to place the shell in a web-accessible directory. The shell.jsp file is a web shell that allows arbitrary command execution via the 'cmd' parameter, returning both stdout and stderr. The README.md provides detailed usage instructions, affected product versions, and post-exploitation tips, such as downloading the WSO2 database file. The exploit is operational and provides remote code execution with potentially superuser privileges if the WSO2 service is run as root. The main attack vector is network-based, targeting the /fileupload endpoint. The repository is well-structured, with clear separation between the exploit script, payload, and documentation.