SSRF and XSS Vulnerabilities in WSO2 Products Affecting Administrative Users

CVE-2025-5350

What is CVE-2025-5350?

Multiple WSO2 products contain vulnerabilities related to server-side request forgery (SSRF) and reflected cross-site scripting (XSS) through the deprecated Try-It feature. This feature, accessible only to administrative users, allows unvalidated user-supplied URLs, enabling attackers to exploit the system by tricking administrators into clicking crafted links. This results in the server fetching malicious content, which is reflected in the admin's browser, allowing for harmful JavaScript execution. Although session cookies are secured with the HttpOnly flag, the potential for data exfiltration and manipulation poses a serious security threat. In addition, the SSRF may permit privileged users to probe internal services, risking internal network enumeration if the targeted endpoints are reachable.

References