VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 23, 2025· Updated Sep 25, 2025

Content Spoofing in Multiple WSO2 Products via Error Message Injection

CVE-2024-6429

Description

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.

By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A content spoofing vulnerability in WSO2 products allows attackers to inject arbitrary content into error messages via unvalidated URL parameters, enabling social engineering attacks.

Vulnerability

Overview

CVE-2024-6429 is a content spoofing vulnerability affecting multiple WSO2 products, including the identity-apps repository. The root cause is improper handling of error messages, where user-supplied input passed through URL parameters are passed through URL parameters without sufficient validation or sanitization [1][2]. This allows an attacker to inject arbitrary content into the error messages displayed in the user's browser.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that includes a specially crafted error message parameter. When a user visits this URL, the WSO2 application will render the attacker-controlled content as part of the error page, without proper escaping or validation [1][2]. No authentication is required to trigger the vulnerability can be triggered by simply luring a victim to click on a crafted link.

Impact

Successful exploitation enables an attacker to manipulate the content of error pages displayed to users. This can be leveraged for social engineering attacks, such as displaying deceptive messages that trick users into revealing sensitive information or performing unintended actions [2]. The vulnerability does not directly allow code execution or data theft, but it undermines the trustworthiness of the application's UI.

Mitigation

The vulnerability has been addressed in the WSO2 identity-apps repository via pull request #6488, which validates the authentication failure message against the resource bundle [1]. The fix is included in release @wso2is/identity-apps-core@2.4.4 [4]. Users are strongly advised to update to the latest patched version of the affected WSO2 products to mitigate the risk.

References
  1. Validate the auth fail massege with the resourceBundle by Yasasr1 · Pull Request #6488 · wso2/identity-apps
  2. NVD - CVE-2024-6429
  3. Release @wso2is/identity-apps-core@2.4.4 · wso2/identity-apps

AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.wso2.identity.apps:authentication-portalMaven
< 2.4.42.4.4

Affected products

3
  • WSO2/WSO2 API Managerv5
    Range: 3.2.0
  • WSO2/WSO2 Identity Serverv5
    Range: 5.10.0
  • WSO2/WSO2 Identity Server as Key Managerv5
    Range: 5.10.0

Patches

1
75babf6b60f9

Merge pull request #6488 from Yasasr1/validate-auth-fail-msg

https://github.com/wso2/identity-appsYasas RamanayakaJun 28, 2024via ghsa
commit
2 files changed · +17 −4
  • .changeset/proud-snakes-sin.md+5 −0 added
    @@ -0,0 +1,5 @@
+---
+"@wso2is/identity-apps-core": patch
+---
+
+Validate the auth fail massege in domain.jsp with the resourceBundle.
  • identity-apps-core/apps/authentication-portal/src/main/webapp/domain.jsp+12 −4 modified
    @@ -28,14 +28,22 @@
 
 <%
     String domainUnknown = AuthenticationEndpointUtil.i18n(resourceBundle, "domain.unknown");
-    String errorMessage = AuthenticationEndpointUtil.i18n(resourceBundle, "authentication.failed");
+    String errorMessage = AuthenticationEndpointUtil.i18n(resourceBundle, "authentication.failed.please.retry");
     boolean loginFailed = false;
     if (Boolean.parseBoolean(request.getParameter("authFailure"))) {
         loginFailed = true;
         if (request.getParameter("authFailureMsg") != null) {
-            errorMessage = request.getParameter("authFailureMsg");
-
-            if (domainUnknown.equalsIgnoreCase(errorMessage)) {
+            /* 
+            * Only allowing error messages defined in the resourceBundle.
+            * AuthenticationEndpointUtil.i18n() will return the value of the provided key if the key is found
+            * in the resourceBundle. If the key is not found, it will return the key itself.
+            */
+            String error = Encode.forJava(request.getParameter("authFailureMsg"));
+            if (!error.equalsIgnoreCase(AuthenticationEndpointUtil.i18n(resourceBundle, error))) {
+                errorMessage = AuthenticationEndpointUtil.i18n(resourceBundle, error);
+            }
+            
+            if (domainUnknown.equalsIgnoreCase(error)) {
                 errorMessage = AuthenticationEndpointUtil.i18n(resourceBundle, "domain.cannot.be.identified");
             }
         }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.