Record · corpus.blog/posts/01a08764-ec06-7312-b155-2b7fa6b2f146

WSO2 #1: 404 to arbitrary file read

crnkovic.dev · published 28 October 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at crnkovic.dev Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 22
Words captured: 3,392

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

WSO2 #2: The many ways to bypass authentication in WSO2 products Read at the source ↗

crnkovic.dev

WSO2 #3: Server-side request forgery Read at the source ↗

crnkovic.dev

https://lokvica.com/discoveries/CVE-2025-2905/

lokvica.com

https://en.wikipedia.org/wiki/WSO2

en.wikipedia.org

https://synapse.apache.org/

synapse.apache.org

https://axis.apache.org/axis2/java/core/index.html

axis.apache.org

https://wso2.com/files/Presentation1_thumb[4].png

wso2.com

https://github.com/wso2/product-apim/blob/v2.0.0/modules/distribution/product/src/main/conf/synapse-configs/default/sequences/main.xml

github.com

https://en.wikipedia.org/wiki/Template_processor

en.wikipedia.org

https://synapse.apache.org/userguide/mediators.html

synapse.apache.org

https://github.com/wso2/wso2-synapse/blob/v2.1.7-wso2v3/modules/core/src/main/java/org/apache/synapse/mediators/transform/PayloadFactoryMediator.java

github.com

https://github.com/wso2/wso2-axiom

github.com

https://github.com/wso2/wso2-axiom/blob/v1.2.11-wso2v11/modules/axiom-api/src/main/java/org/apache/axiom/om/util/AXIOMUtil.java

github.com

https://archive.is/VUYLV

archive.is

https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE

owasp.org

https://portswigger.net/web-security/xxe/blind

portswigger.net

https://en.wikipedia.org/wiki/Document_type_definition

en.wikipedia.org

https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/

blog.assetnote.io

https://github.com/wso2/product-apim/commit/95ff0d37071867c6e3b172936ff1e4e67495a7c6

github.com

https://wso2docs.atlassian.net/wiki/spaces/ESB490/pages/624350/PayloadFactory+Mediator

wso2docs.atlassian.net

https://github.com/wso2/product-apim/blob/727d091683c8199c37f2d19ab3198abee6553904/modules/distribution/product/src/main/conf/synapse-configs/default/proxy-services/WorkflowCallbackService.xml

github.com

https://www.rfc-editor.org/rfc/rfc9112.html

rfc-editor.org