WSO2-2021-1258: Zip Slip vulnerability in WSO2 ESB

A ZIP file based directory traversal (Zip Slip) vulnerability was identified in the WSO2 Management Console. Remote code execution may be obtained by writing/overwriting specific files.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Why no CVE?

Neither me nor the vendor requested a CVE for this vulnerability.

Requirements:

This vulnerability requires:

• Valid user credentials

Proof Of Concept:

More details and the exploitation process can be found in this PDF.