WSO2 Micro Integrator

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (CVSS 9.0-10.0) │ $500 │ $625 High (CVSS 7.0-8.9) │ $250 │ $313 Medium (CVSS 4.0-6.9) │ $100 │ $125 Low (CVSS >0 to 3.9) │ $50 │ $63 Submit a vulnerability CVE history 2 Last 12 months 5 Lifetime Injection 30 % Access control 25 % Auth bypass 25 % Info disclosure 15 % Latest advisories Loading the feed Overview WSO2 Micro Integrator is the Apache-2.0 enterprise service bus in wso2/product-integrator-mi : the repository moved there, and wso2/micro-integrator now 301-redirects to it: a Synapse-based mediation runtime whose entire job is to accept untrusted payloads from one system, transform them and hand them to another. It is heavily deployed in government digital-identity and open-banking programmes across Europe, Latin America, South Asia and the Gulf, in telco BSS and OSS stacks, and in healthcare integration: regulated, internet-facing and slow to patch, which is the worst combination available and the reason WSO2 integration CVEs keep reaching CISA's Known Exploited Vulnerabilities catalogue. The CVE counts on Micro Integrator's own identifier are modest at five lifetime and two in the last year, but they understate the code lineage: the predecessor Enterprise Integrator carries 32 lifetime and 11 in the last twelve months, and that line is where CVE-2022-29464 lived; an unauthenticated arbitrary file upload leading to remote code execution that was exploited in the wild at scale. WSO2 pays for exactly that class of finding by CVSS band, $500 for a Critical down to $50 for a Low, in cash by PayPal or as an Amazon voucher at the reporter's choice. The ceiling is small enough that the uplift dominates it: sorona.xyz adds 1.25× on top of whatever WSO2 awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The WSO2 Reward and Acknowledgement Program declares five product families in scope: Agent Platform, API Platform, Integration Platform, Identity Platform and Developer Platform. Micro Integrator is the Integration Platform product, and the build the programme points you at is the self-hosted Apache-2.0 distribution wso2/product-integrator-mi The programme fixes the testing target rather than the bug class: any security issue you can demonstrate on a WSO2 build running on infrastructure you control, on a deployment you own, or in your own tenant of a WSO2 cloud service The Synapse-based mediation engine in full: sequences and mediators, message transformation between XML, JSON and the other supported formats, XPath and XSLT evaluation, proxy services, deployed REST APIs, and message stores and processors Every inbound endpoint and transport the runtime listens on, including HTTP and HTTPS, JMS, file and FTP polling, and Kafka Connector execution and the data services layer, which reach databases and third-party systems on behalf of a mediation flow The management API, the MI Dashboard and the command-line tooling, with their authentication, role enforcement and every administrative operation they expose Configuration and secret handling: the secure vault, secret resolution, keystores, and the backend credentials the runtime holds for every system behind it Out of scope WSO2-operated websites such as wso2.com, internal staging environments and demo sites, all named out of scope by the programme Any customer-owned deployment of WSO2 software: the target is your own instance or your own tenant, and somebody else's installation is out of bounds Third-party assets and non-WSO2 domains, which belong to whoever runs them Network-level and volumetric denial of service. Application-level DoS against your own self-hosted instance is the part that stays in scope Self-XSS, clickjacking without demonstrated impact, version disclosure, stack traces, missing headers and TLS hardening preferences standing on their own Out-of-date third-party libraries with no working exploit against the shipped product, and any report without a working proof of concept Duplicates: only the first reporter of an issue is paid Most-valued findings Pre-authentication remote code execution on a stock install: arbitrary file upload, unsafe deserialization or an unauthenticated management endpoint. This is precisely the CVE-2022-29464 shape on this code lineage, it is what put WSO2 integration products in CISA KEV, and it is the class that grades 9.0 or above and pays the $500 top rung. Injection reachable from a message body: XXE, entity expansion, XPath or XSLT injection, or expression injection in a mediator, since the runtime parses documents it has no reason to trust before anything has authorised the sender Authentication bypass or privilege escalation on the management API and MI Dashboard, together the administrative control plane for every integration the node runs. Auth bypass and access control are each a quarter of the recorded bug history here. Secret disclosure out of the secure vault or the secret-resolution path, because the credentials an ESB holds are credentials for the backends behind it rather than for the ESB itself Defects reachable through an inbound endpoint or a connector, whether HTTP, JMS, file or Kafka, since that is the part of the product designed to take input from systems you do not control Anything demonstrated on a default configuration rather than on one the reporter had to weaken first, since WSO2 grades severity itself and a self-inflicted configuration is excluded outright Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Test only against a self-hosted WSO2 build on infrastructure you control, a deployment you own, or your own tenant in a WSO2 cloud service: WSO2-operated sites, demo environments and customer deployments are all excluded Rewards go to the first reporter only, so a duplicate earns nothing however good the writeup WSO2 sets severity itself using CVSS v3.1 and the payout decision is at its discretion; the fix window runs up to 90 days and the reward issues only after the fix is announced All communications about a report must use the channels WSO2 documents: public posts that violate responsible disclosure, or that reflect negatively on the programme, disqualify the reporter Work against wso2/product-integrator-mi : wso2/micro-integrator 301-redirects there, and a report written against the old path is a report against a repository that no longer exists Disclosure Coordinated with WSO2's security team through [email protected] , the address product-integrator-mi 's SECURITY.md points at. That policy asks you not to disclose in any forum, public or private, until WSO2 has completed its vulnerability management process, bounded by the fix rather than indefinite, so sorona.xyz holds your finding until the advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability