CVE-2022-34267
📋 TL;DR
CVE-2022-34267 is an authentication bypass vulnerability in RWS WorldServer that allows unauthenticated attackers to upload and execute arbitrary Java code. By adding a specific token parameter (value '02') to requests, attackers can bypass all authentication requirements and upload malicious .jar files to the ws-api/v2/customizations/api endpoint. This affects all WorldServer installations before version 11.7.3.
💻 Affected Systems
- RWS WorldServer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data exfiltration, ransomware deployment, and lateral movement across the network.
Likely Case
Unauthenticated attackers gaining administrative access, installing backdoors, stealing sensitive translation/localization data, and maintaining persistent access.
If Mitigated
Attackers blocked at network perimeter or detected during initial exploitation attempts, limiting impact to isolated systems.
🎯 Exploit Status
Exploitation requires only HTTP requests with specific parameters and file uploads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.7.3
Vendor Advisory: https://www.rws.com/localization/products/trados-enterprise/worldserver/
Restart Required: Yes
Instructions:
1. Download WorldServer 11.7.3 or later from RWS support portal. 2. Backup current installation and data. 3. Run the upgrade installer following RWS documentation. 4. Restart WorldServer services. 5. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allUse web application firewall or network controls to block access to /ws-api/v2/customizations/api endpoint
# Example WAF rule to block the endpoint
# Example: deny http any any -> any any (msg:"Block WorldServer CVE-2022-34267"; content:"/ws-api/v2/customizations/api"; sid:1000001;)
Network Segmentation
linuxRestrict access to WorldServer to only trusted internal networks
# Example firewall rule (iptables)
iptables -A INPUT -p tcp --dport [WorldServer_port] -s [trusted_network] -j ACCEPT
iptables -A INPUT -p tcp --dport [WorldServer_port] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WorldServer from internet and untrusted networks
- Deploy web application firewall with rules to detect and block exploitation attempts targeting the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check WorldServer version via admin interface or by examining installation files. Versions below 11.7.3 are vulnerable.Check Version:
Check WorldServer admin dashboard or installation directory for version informationVerify Fix Applied:
After patching, attempt to access /ws-api/v2/customizations/api with token=02 parameter. Should return authentication error instead of allowing access.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /ws-api/v2/customizations/api with token=02 parameter
- File uploads of .jar files to customization endpoints
- Unusual Java process execution from WorldServer context
Network Indicators:
- POST requests to /ws-api/v2/customizations/api with multipart/form-data containing .jar files
- HTTP requests with token=02 parameter in URL or headers
SIEM Query:
source="worldserver" AND (url="/ws-api/v2/customizations/api" OR (method="POST" AND content_type="multipart/form-data" AND file_extension=".jar"))