EUVD-2025-210631
GHSA-8rr2-f52p-r9q3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attacker needs no credentials (PR:N) but victim must be actively tricked (UI:R); GET-based CSRF yields limited state modification (I:L) and potential session/account disruption (A:L) with no confidentiality exposure (C:N).
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
2DescriptionCVE.org
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions.
An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.
AnalysisAI
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Technical ContextAI
The Carbon console is WSO2's shared legacy administrative web interface underlying all major WSO2 middleware products, as confirmed by CPE data spanning Identity Server, API Manager, Open Banking IAM/AM, Enterprise Integrator, API Control Plane, Universal Gateway, Traffic Manager, and numerous Carbon UI subcomponents. The root cause is CWE-352 (Cross-Site Request Forgery), compounded by an architectural choice to serve state-changing Ajax operations over HTTP GET rather than POST. This design makes conventional CSRF synchronizer-token mitigations inapplicable, because those patterns rely on embedding a secret in the request body or as a non-GET parameter. The SameSite=Lax cookie attribute was deployed as a substitute mitigation, but the Lax policy explicitly permits cookies to be transmitted on cross-origin top-level navigation GET requests - for example, when a user follows a hyperlink or is redirected - which is precisely the vector this attack exploits. A complete CSRF defense would require SameSite=Strict, custom Origin/Referer header validation, or anti-CSRF tokens embedded in all state-changing requests.
RemediationAI
Apply the fix documented in WSO2 security advisory WSO2-2025-4800 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/); no specific patched version number was available in the input data, so consult the advisory directly for exact upgrade targets. The single most effective compensating control - and WSO2's own stated recommendation - is to ensure the Carbon console and all WSO2 management interfaces are network-isolated and not reachable from the public internet; if followed, this eliminates the external CSRF attack surface entirely. Where immediate network isolation is not feasible, consider upgrading the Carbon console session cookie to SameSite=Strict (which blocks all cross-origin cookie transmission, including top-level GET navigation), though this change may break legitimate cross-origin SSO or redirect flows and should be tested in staging first. Alternatively, deploying a WAF rule to validate that the HTTP Referer or Origin header on Carbon Ajax endpoints matches the expected management domain can block cross-origin CSRF requests, but this control is bypassable if Referer stripping is in play and requires precise rule authoring. Network isolation remains the recommended primary control; cookie and WAF mitigations are secondary and should not substitute for the vendor patch.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today