CVE-2024-4989: Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.
Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to convince a user to interact with a malicious link that supplies an attacker-controlled callback URL. No authentication or special privileges are required, but user interaction is necessary.
Who is most exposed to this vulnerability?
Users of WSO2 API Manager who can be directed to attacker-crafted links are exposed to phishing and redirection to attacker-controlled pages. The impact depends on successful social engineering rather than direct compromise without user involvement.
What is the likely impact if exploitation succeeds?
A user may be redirected to an attacker-controlled website that impersonates a trusted destination or solicits sensitive information. The stated impact includes low confidentiality and integrity effects, with no availability impact.