CVE-2022-34267

published 2023-12-25

CVE-2022-34267: An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary…

Priority P1 80 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
rws	worldserver	< 11.7.3	11.7.3

Detection & IOCs extracted from sources · hover to see the quote

url /ws-api/v2/users/me/details?token=02↗

url /ws-api/v2/customizations/api↗

other token=02↗

• → Detect unauthenticated access attempts using the magic bypass token value '02' in requests to the WorldServer API — look for GET/POST requests to /ws-api/v2/ paths containing the query parameter token=02. ↗
• → Monitor for JAR file uploads to the /ws-api/v2/customizations/api endpoint, which can be used for remote code execution after authentication bypass. ↗
• → A successful authentication bypass will return HTTP 200 with a JSON body containing '"fullName":"System"' — use this as a confirmation indicator in detection rules. ↗
• → Use Shodan query title:"WorldServer" to identify exposed RWS WorldServer instances that may be vulnerable. ↗

• · The vulnerability affects RWS WorldServer versions before 11.7.3 only; patched instances (11.7.3+) should not be susceptible to the token=02 bypass. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287