CVE-2024-5563: 
WSO2 Identity Server vulnerability analysis and mitigation

CVE-2024-5563 is an authentication bypass vulnerability in WSO2 Identity Server caused by an incomplete reCaptcha implementation. Even when the reCaptcha option is enabled, it is not applied to certain authentication flows, allowing attackers to bypass the intended bot/brute-force protection mechanism. The vulnerability affects WSO2 Identity Server versions 7.0.0 through 7.0.0.37 (exclusive). It carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, WSO2 Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function) — specifically, an incomplete implementation where reCaptcha validation is not enforced across all authentication flows despite being configured as enabled. An unauthenticated remote attacker can target the unprotected authentication endpoints directly, bypassing the reCaptcha challenge entirely and submitting automated credential attempts without triggering the protection mechanism. No special privileges or user interaction are required, though the attack complexity is rated High, suggesting some conditions or knowledge of the specific unprotected flows may be needed (GitHub Advisory, WSO2 Advisory).

Successful exploitation allows an unauthenticated attacker to conduct automated brute force attacks against user accounts on WSO2 Identity Server without being blocked by reCaptcha. This can result in unauthorized access to user accounts and exposure of sensitive information managed by the identity server, including credentials, profile data, and potentially tokens used for downstream service access. Availability is not directly impacted, but confidentiality and integrity are both at low risk per the CVSS assessment (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, indicating a very low current probability of exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing WSO2 Identity Server instances running versions 7.0.0 to below 7.0.0.37 using tools like Shodan or Censys, or by inspecting login page metadata.
2. Identify unprotected authentication flows: Probe the WSO2 Identity Server authentication endpoints to determine which flows (e.g., specific login or password recovery endpoints) do not enforce reCaptcha validation despite the feature being enabled in configuration.
3. Automate credential attempts: Using a tool such as Burp Suite Intruder, Hydra, or a custom script, send repeated authentication requests to the identified unprotected endpoint with a list of username/password combinations, bypassing the reCaptcha challenge entirely.
4. Achieve unauthorized access: Upon a successful credential match, use the obtained session token or credentials to access the target user account and any sensitive information or downstream services accessible through WSO2 Identity Server (GitHub Advisory, WSO2 Advisory).

• Network: High volume of authentication requests from a single IP or small IP range to WSO2 Identity Server login endpoints in a short time window; requests targeting specific authentication flows that bypass reCaptcha.
• Logs: WSO2 Identity Server access logs showing repeated failed login attempts (HTTP 401/403 responses) followed by a successful authentication from the same source; absence of reCaptcha validation log entries for authentication attempts on affected flows.
• Process/Application: Unusual spike in authentication events in WSO2 audit logs; account lockout events (if lockout policy is configured) triggered for multiple accounts in rapid succession.

WSO2 has released a patch for WSO2 Identity Server; users should upgrade to version 7.0.0.37 or later to remediate this vulnerability (WSO2 Advisory). As defense-in-depth measures, administrators should implement account lockout policies and rate limiting on authentication endpoints to reduce the effectiveness of brute force attacks even if reCaptcha is bypassed. Additionally, enabling multi-factor authentication (MFA) for user accounts will significantly reduce the risk of unauthorized access even if credentials are compromised through brute force.