Detect WSO2 Multiple Products Path Traversal / Signature Verification Bypass (CVE-2026-5430) in IBM QRadar
Detects exploitation attempts against CVE-2026-5430, a KEV-listed vulnerability affecting multiple WSO2 products (API Manager, Identity Server, Enterprise Integrator, and others). The advertised weakness is a path traversal (directory traversal) issue with an associated improper verification of cryptographic signature (CWE-347) that allows attackers to bypass content/signature validation and access or write files outside the intended directory via crafted request paths. Exploitation typically manifests as encoded traversal sequences (../, %2e%2e%2f, ..%252f) in URI paths, multipart file-upload endpoints, or authentication callback parameters against WSO2 management/carbon and gateway endpoints. Because CISA lists this CVE as actively exploited (KEV), any successful traversal reaching sensitive files (e.g. repository/conf, wso2carbon keystores, deployment artifacts) should be treated as a probable compromise.
MITRE ATT&CK
- Tactic
- Initial Access Collection
QRadar Detection Query
SELECT sourceip, destinationip, "URL", "Request Method", "HTTP Response Code", "User Agent", starttime
FROM events
WHERE ("URL" ILIKE '%/carbon%' OR "URL" ILIKE '%/services/%' OR "URL" ILIKE '%/fileupload%' OR "URL" ILIKE '%/oauth2/%' OR "URL" ILIKE '%/authenticationendpoint%')
AND ( "URL" ILIKE '%..%2f%' OR "URL" ILIKE '%../%' OR "URL" ILIKE '%2e%2e%' OR "URL" ILIKE '%252e%' OR "URL" ILIKE '%..%255c%' )
AND ( "URL" ILIKE '%repository/conf%' OR "URL" ILIKE '%wso2carbon%' OR "URL" ILIKE '%.jks%' OR "URL" ILIKE '%deployment.toml%' OR "URL" ILIKE '%secret-conf%' )
ORDER BY starttime DESC LAST 24 HOURSQRadar AQL query over web/proxy events searching for encoded traversal sequences against WSO2 endpoints reaching sensitive configuration files.
Data Sources
Required Tables
False Positives & Tuning
- Sanctioned vulnerability scans
- WAF log-forwarding that duplicates malicious samples
- Legitimate deep links containing encoded characters
Other platforms for CVE-2026-5430
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Encoded path traversal probe against WSO2 carbon endpoint
Expected signal: Reverse-proxy/IIS access log entry with encoded '..%2f' sequences on a /carbon path targeting repository/conf/deployment.toml.
- Test 2Double-encoded traversal to keystore file
Expected signal: Web access log with '%252f' sequences on /fileupload targeting wso2carbon.jks.
- Test 3Windows-hosted WSO2 traversal probe via PowerShell
Expected signal: IIS/reverse-proxy log with '%255c' encoded backslash traversal on /services targeting secret-conf.
References (4)
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-5430
Response Playbook
Triage
- Confirm the target host runs an affected WSO2 product (API Manager, Identity Server, Enterprise Integrator, Micro Integrator) and identify its exact version against advisory WSO2-2026-5328.
- URL-decode the full request path/query from the alert and determine whether the traversal reached a sensitive file (repository/conf/*, *.jks keystore, deployment.toml, secret-conf) versus a probe that was blocked (check HTTP status: 200/206 with body bytes indicates likely success).
- Correlate the source IP against threat-intel and prior activity; determine if it is a known scanner, an authorized tester, or an unattributed external host.
- Pull the WSO2 carbon/gateway access and audit logs around the request time to see if the same source subsequently authenticated, uploaded artifacts, or accessed OAuth/token endpoints.
Containment
- If successful traversal to configuration or keystore files is confirmed, isolate the WSO2 node from untrusted networks and route traffic to a patched/known-good instance.
- Block the offending source IP(s) at the WAF/reverse proxy and add a WAF rule rejecting encoded '..' sequences on WSO2 endpoints as a stopgap until patching completes.
- Rotate any secrets that may have been exposed: wso2carbon.jks and internal keystore passwords, admin credentials, OAuth client secrets, and any tokens stored in exposed config.
Evidence Collection
- Preserve the raw web/reverse-proxy access logs and WSO2 carbon/audit logs covering the exploitation window before rotation or reimaging.
- Capture the affected WSO2 filesystem (repository/conf, repository/deployment, and keystore directories) with hashes to establish which files were read or modified.
- Export network flow/PCAP for the source IP to document data exfiltration volume and any follow-on connections.
Escalation Criteria
- !Escalate to incident response immediately if a traversal request returned sensitive keystore or configuration content (HTTP 200 with non-trivial response size).
- !Escalate if post-exploitation activity is observed — new artifact deployment, unexpected admin logins, OAuth client creation, or outbound C2 from the WSO2 host.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
WSO2 carbon access logs and wso2carbon audit logs (repository/logs/) - >
Reverse-proxy/IIS/Nginx access logs containing the decoded traversal request - >
Timestamps and hashes of files under repository/conf and keystore directories - >
WAF event logs for blocked vs allowed traversal attempts
Tuning Guidance
Baseline authorized scanner source IPs (internal vuln-management ranges, contracted pen-test hosts) and exclude them or route their alerts to a low-severity queue. Ensure logging captures the full raw URI and query string BEFORE any proxy normalization strips '..' sequences, otherwise decoded-traversal detection will miss double-encoded payloads. If your reverse proxy already rejects encoded traversal with a 400/403, prioritize alerts on requests that returned 200/206 to focus on likely-successful exploitation.
Hunting Queries
Surfaces repeated traversal attempts from a single source that target WSO2 keystore/config files, indicating deliberate exploitation rather than a one-off scan.
W3CIISLog | extend d = url_decode(strcat(csUriStem,"?",coalesce(csUriQuery,"-"))) | where d contains ".." and d has_any("wso2carbon","repository/conf",".jks","deployment.toml") | summarize hits=count(), files=make_set(d) by cIP | where hits > 1index=web (uri_path="*/carbon*" OR uri_path="*/services/*") | eval d=urldecode(uri_path."?".coalesce(uri_query,"-")) | where match(d,"(?i)\.\.") AND match(d,"(?i)(wso2carbon|repository/conf|\.jks|deployment\.toml)") | stats count values(d) as payloads by src_ipAtomic Red Team Tests
Sends a single-encoded traversal request targeting a WSO2 configuration file to validate detection of decoded '../' sequences on WSO2 endpoints.
Command
curl -sk 'https://wso2-lab.internal:9443/carbon/..%2f..%2f..%2frepository%2fconf%2fdeployment.toml' -o /tmp/wso2_trav_test.outCleanup
rm -f /tmp/wso2_trav_test.outExpected Telemetry
Reverse-proxy/IIS access log entry with encoded '..%2f' sequences on a /carbon path targeting repository/conf/deployment.toml.
Expected Detection
KQL/SPL rule fires on decoded traversal reaching 'repository/conf' / 'deployment.toml'.
Issues a double-encoded (%252e) traversal request aimed at the wso2carbon.jks keystore to test double-decoding logic.
Command
curl -sk 'https://wso2-lab.internal:9443/fileupload/..%252f..%252frepository%252fresources%252fsecurity%252fwso2carbon.jks' -o /tmp/wso2_jks_test.outCleanup
rm -f /tmp/wso2_jks_test.outExpected Telemetry
Web access log with '%252f' sequences on /fileupload targeting wso2carbon.jks.
Expected Detection
Detection matches on '%252e'/'wso2carbon'/'.jks' patterns after decoding.
Uses PowerShell to send a backslash-encoded traversal against a Windows-hosted WSO2 gateway to validate cross-platform log coverage.
Command
powershell -c "try { Invoke-WebRequest -Uri 'https://wso2-lab.internal:8243/services/..%255c..%255crepository%255cconf%255csecret-conf%255csecret.properties' -SkipCertificateCheck -OutFile $env:TEMP\wso2_win_test.out } catch {}"Cleanup
powershell -c "Remove-Item -Force $env:TEMP\wso2_win_test.out -ErrorAction SilentlyContinue"Expected Telemetry
IIS/reverse-proxy log with '%255c' encoded backslash traversal on /services targeting secret-conf.
Expected Detection
Rule matches encoded backslash traversal ('..%255c') reaching 'secret-conf'.