CVE-2024-50848 PoC — RWS WorldServer 安全漏洞

Source

https://github.com/Wh1teSnak3/CVE-2024-50848

Associated Vulnerability

Title:RWS WorldServer 安全漏洞 (CVE-2024-50848)
Description:An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file.

Readme

# CVE-2024-50848: XXE in the WorldServer v11.8.2

An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 might lead to access sensitive system information and execute arbitrary commands via supplying a crafted .tmx file.

To exploit this vulnerability, an authenticated attacker has to craft a .tmx file containing the malicious payload with the path to the existing system file or directory. After uploading the file with malicious content, the target server will respond with the specified system folder or file content in the warning message.

Discovered by Nikita Hrab, July 2024

References:
https://www.trados.com/product/worldserver/

File Snapshot


 [4.0K]  /data/pocs/e5006e8cf8ddc16a3e48735b2b976f4778d979c8
├── [ 300]  PoC.tmx
└── [ 719]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!