CVE-2020-14444: Reflected XSS in WSO2 Identity Server

Reflected Cross-Site Scripting in WSO2 Product

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Policy Administration user interface.

CVE IDCVE-2020-14444

CVSS v3.15.4 Medium

VendorWSO2

CWECWE-79

DisclosedFeb 10, 2020

StatusFixed

01/Description

What this actually is.

Technical background, root cause, and affected surface.

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted web site. The application targets your users and not the application itself, but it uses your application as the vehicle for the attack. XSS payload is executed when the user loads a page created in WSO2 Identity Server version 5.9.0 Product.

*Affected Products: WSO2 IS as Key Manager 5.9.0 or earlier, WSO2 Identity Server 5.9.0 or earlier

Vendor: WSO2
Affected Product: See Full List Below*
CVE: CVE-2020-14444
Securin ID: 2020-CSW-05-1042
Status: Fixed
Date: February 10, 2020
Severity: Medium
CVSS Score: 5.4
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

02/Proof of Concept

From one request
to root shell.

Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ScopeChanged

ImpactC:L / I:L / A:N

SeverityMedium

The following vulnerability was tested on WSO2 Identity Server version 5.9.0 Product.

PoC · Exploitation Steps▲ trigger

01Issue 01: Persistent Cross-Site scripting.02Figure 01: Navigating to the Policy Administration and Clicking the Add New Entitlement Policy Link.03Figure 02: Clicking the Write Policy in XML will open the (URL) Editor.04Figure 03: Injected Payload gets reflected in the Response body of the Policy editor page.05Figure 04: Payload gets Executed on the page.

03/Impact

What an attacker does to you.

Post-exploitation outcomes mapped to CVSS impact metrics.

By leveraging an XSS attack, an attacker can make the browser get redirected to a malicious website, make changes in the UI of the web page, retrieve information from the browser or harm otherwise. However, since all the session related sensitive cookies are set with httpOnly flag and protected, session hijacking or similar attacks would not be possible.

04/Remediation

Fix it. In this order.

A runbook, not a checklist. Sequence matters — assume compromise before you act.

Download and apply the relevant fixes based on the changes from the public fix:

https://github.com/wso2/carbon-identity-framework/pull/2738

Securin advisory — For coordinated remediation support or threat-actor briefings related to CVE-2020-14444, contact disclose@securin.io

05/Disclosure Timeline

Vendors moved in days.
Attackers in hours.

Reconstructed from vendor advisories, CISA bulletins, and Securin research records.

Jan 31, 2020

Discovered in WSO2 Identity Server Manager version 5.9.0.

Feb 04, 2020

CSW conducted an Internal Review

Feb 10, 2020

Reported to the WSO2 security team

Timeline recorded · Disclosure coordinated by Securin

06/References

Cite, verify, go deeper.

Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

NVD

NVD — CVE-2020-14444

nvd.nist.gov/vuln/detail/CVE-2020-14444 →

SEC

Securin VI — Full Technical Analysis

vi.securin.io →

Reflected Cross-Site Scripting in WSO2 Product

CVE IDCVE-2020-14444

CVSS v3.15.4 Medium

VendorWSO2

CWECWE-79

DisclosedFeb 10, 2020

StatusFixed

01/Description

What this actually is.

Technical background, root cause, and affected surface.

*Affected Products: WSO2 IS as Key Manager 5.9.0 or earlier, WSO2 Identity Server 5.9.0 or earlier

Vendor: WSO2
Affected Product: See Full List Below*
CVE: CVE-2020-14444
Securin ID: 2020-CSW-05-1042
Status: Fixed
Date: February 10, 2020
Severity: Medium
CVSS Score: 5.4
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

02/Proof of Concept

From one request
to root shell.

Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ScopeChanged

ImpactC:L / I:L / A:N

SeverityMedium

The following vulnerability was tested on WSO2 Identity Server version 5.9.0 Product.

PoC · Exploitation Steps▲ trigger

03/Impact

What an attacker does to you.

Post-exploitation outcomes mapped to CVSS impact metrics.

04/Remediation

Fix it. In this order.

A runbook, not a checklist. Sequence matters — assume compromise before you act.

Download and apply the relevant fixes based on the changes from the public fix:

https://github.com/wso2/carbon-identity-framework/pull/2738

Securin advisory — For coordinated remediation support or threat-actor briefings related to CVE-2020-14444, contact disclose@securin.io

05/Disclosure Timeline

Vendors moved in days.
Attackers in hours.

Reconstructed from vendor advisories, CISA bulletins, and Securin research records.

Jan 31, 2020

Discovered in WSO2 Identity Server Manager version 5.9.0.

Feb 04, 2020

CSW conducted an Internal Review

Feb 10, 2020

Reported to the WSO2 security team

Timeline recorded · Disclosure coordinated by Securin

06/References

Cite, verify, go deeper.

Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

NVD

NVD — CVE-2020-14444

nvd.nist.gov/vuln/detail/CVE-2020-14444 →

SEC

Securin VI — Full Technical Analysis

vi.securin.io →

Reflected Cross-Site Scripting in WSO2 Product

What this actually is.

From one request
to root shell.

What an attacker does to you.

Fix it. In this order.

Vendors moved in days.
Attackers in hours.

Discovered in WSO2 Identity Server Manager version 5.9.0.

CSW conducted an Internal Review

Reported to the WSO2 security team

Cite, verify, go deeper.

NVD — CVE-2020-14444

Securin VI — Full Technical Analysis

Let Securin level up your security posture.

Reflected Cross-Site Scripting in WSO2 Product

What this actually is.

From one request
to root shell.

What an attacker does to you.

Fix it. In this order.

Vendors moved in days.
Attackers in hours.

Discovered in WSO2 Identity Server Manager version 5.9.0.

CSW conducted an Internal Review

Reported to the WSO2 security team

Cite, verify, go deeper.

NVD — CVE-2020-14444

Securin VI — Full Technical Analysis

Let Securin level up your security posture.

Reflected Cross-Site Scripting in WSO2 Product

What this actually is.

From one requestto root shell.

What an attacker does to you.

Fix it. In this order.

Vendors moved in days.Attackers in hours.

Discovered in WSO2 Identity Server Manager version 5.9.0.

CSW conducted an Internal Review

Reported to the WSO2 security team

Cite, verify, go deeper.

NVD — CVE-2020-14444

Securin VI — Full Technical Analysis

Let Securin level up your security posture.

Reflected Cross-Site Scripting in WSO2 Product

What this actually is.

From one requestto root shell.

What an attacker does to you.

Fix it. In this order.

Vendors moved in days.Attackers in hours.

Discovered in WSO2 Identity Server Manager version 5.9.0.

CSW conducted an Internal Review

Reported to the WSO2 security team

Cite, verify, go deeper.

NVD — CVE-2020-14444

Securin VI — Full Technical Analysis

Let Securin level up your security posture.

From one request
to root shell.

Vendors moved in days.
Attackers in hours.

From one request
to root shell.

Vendors moved in days.
Attackers in hours.