CVE-2022-22916
📋 TL;DR
O2OA v6.4.7 contains a remote code execution vulnerability in the /x_program_center/jaxrs/invoke endpoint that allows unauthenticated attackers to execute arbitrary code on affected systems. This affects all organizations running vulnerable versions of O2OA, an open-source enterprise collaboration platform. The vulnerability is particularly dangerous because it requires no authentication and has public exploit code available.
💻 Affected Systems
- O2OA
📦 What is this software?
O2oa by Zoneland
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal sensitive data, pivot to internal networks, and establish persistent backdoors.
Likely Case
Attackers gain shell access to the server, deploy ransomware or cryptocurrency miners, and exfiltrate application data and credentials.
If Mitigated
Attack attempts are blocked at network perimeter, or systems are patched before exploitation occurs.
🎯 Exploit Status
Public GitHub repository contains working proof-of-concept exploit code that demonstrates remote code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after v6.4.7 (check O2OA official releases)
Vendor Advisory: http://o2oa.com
Restart Required: Yes
Instructions:
1. Backup current O2OA installation and data. 2. Download latest O2OA version from official website. 3. Stop O2OA service. 4. Replace installation with patched version. 5. Restart O2OA service. 6. Verify functionality.
🔧 Temporary Workarounds
Block vulnerable endpoint
allUse web application firewall or reverse proxy to block access to /x_program_center/jaxrs/invoke
# Example nginx location block:
location /x_program_center/jaxrs/invoke { deny all; }
# Example Apache .htaccess:
<Location "/x_program_center/jaxrs/invoke">
Order deny,allow
Deny from all
</Location>
Network segmentation
linuxRestrict network access to O2OA instances to trusted IP addresses only
# Example iptables rule:
iptables -A INPUT -p tcp --dport [O2OA_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [O2OA_PORT] -j DROP
🧯 If You Can't Patch
- Immediately isolate affected systems from internet and restrict internal network access
- Implement strict monitoring and alerting for exploitation attempts on the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if O2OA version is v6.4.7 or potentially earlier versions. Test endpoint accessibility: curl -X POST http://[target]/x_program_center/jaxrs/invokeCheck Version:
Check O2OA web interface or installation directory for version informationVerify Fix Applied:
Verify O2OA version is updated beyond v6.4.7. Test that the vulnerable endpoint no longer executes arbitrary code.📡 Detection & Monitoring
Log Indicators:
- POST requests to /x_program_center/jaxrs/invoke with suspicious payloads
- Unusual process execution from O2OA service account
- Error logs containing Java serialization or reflection errors
Network Indicators:
- Unusual outbound connections from O2OA server
- Traffic patterns suggesting command and control communication
- POST requests to invoke endpoint from unexpected sources
SIEM Query:
source="o2oa" AND (url="/x_program_center/jaxrs/invoke" OR process="java" AND cmdline="*Runtime*" OR user="o2oa" AND event="process_create")