CVE-2022-34269
📋 TL;DR
This vulnerability allows authenticated attackers to perform blind Server-Side Request Forgery (SSRF) attacks against RWS WorldServer, enabling them to deploy JSP code to the Apache Axis service on localhost and achieve remote command execution. It affects organizations running vulnerable versions of RWS WorldServer before 11.7.3. Attackers need valid credentials to exploit this vulnerability.
💻 Affected Systems
- RWS WorldServer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with the privileges of the WorldServer service, potentially leading to data theft, lateral movement, or complete system takeover.
Likely Case
Unauthorized command execution on the WorldServer host, enabling data exfiltration, installation of backdoors, or disruption of localization services.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and monitoring preventing successful exploitation.
🎯 Exploit Status
Exploitation requires authenticated access but uses straightforward SSRF techniques to achieve RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.7.3
Vendor Advisory: https://www.rws.com/localization/products/trados-enterprise/worldserver/
Restart Required: Yes
Instructions:
1. Download WorldServer 11.7.3 or later from RWS support portal. 2. Backup current installation and data. 3. Run the upgrade installer following RWS documentation. 4. Restart WorldServer services.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to WorldServer and isolate it from sensitive systems.
Authentication Hardening
allImplement strong authentication controls and monitor for suspicious login attempts.
🧯 If You Can't Patch
- Implement strict network access controls to limit WorldServer exposure
- Monitor for suspicious requests to ws-legacy/load_dtd endpoints
🔍 How to Verify
Check if Vulnerable:
Check WorldServer version via admin interface or configuration files. Versions below 11.7.3 are vulnerable.Check Version:
Check WorldServer admin dashboard or consult installation documentation for version information.Verify Fix Applied:
Confirm version is 11.7.3 or higher and test that ws-legacy/load_dtd endpoint no longer accepts malicious system_id parameters.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to ws-legacy/load_dtd endpoints
- Suspicious JSP file deployment
- Unexpected Apache Axis service activity
Network Indicators:
- HTTP requests with SSRF payloads to WorldServer
- Outbound connections from WorldServer to internal services
SIEM Query:
source="worldserver" AND (uri="*ws-legacy/load_dtd*" OR process="axis")