External risk intelligence

O2OA RCE Vulnerability in Jaxrs Invoke Endpoint.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-22916

O2OA is a web-based enterprise application platform that provides portal and API services. Such platforms are commonly deployed as web applications reachable from the internet to facilitate remote work and business process management, placing the vulnerable endpoint directly on the network edge in typical configurations.

Remote Code Execution

Zoneland O2oa

6.4.7

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in O2OA, a web-based enterprise application platform. This issue allows for remote code execution, meaning an unauthorized party could potentially take control of the system by exploiting this flaw. The primary concern is to determine if our organization utilizes O2OA and if it is exposed externally.

Unauthorized control of systems is possible.
Essential to check for O2OA usage and exposure.
Confirm relevance to protect core business functions.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending a crafted request to the `/x_program_center/jaxrs/invoke` endpoint. This endpoint is exposed to the network, meaning an attacker does not need any special access to interact with it. When the vulnerability is triggered, it can lead to remote code execution, allowing an attacker to run arbitrary commands on the server.

No authentication or user interaction needed.
Crafted network request to specific endpoint.
Remote code execution on server.

Live Threat

Current exploitation, exposure, and threat context

The O2OA platform, when deployed and exposed to a network, could allow an unauthenticated attacker to execute arbitrary code. This is possible through a vulnerability in the `/x_program_center/jaxrs/invoke` endpoint, which does not require any user interaction or privileges to exploit. The platform's nature as a web-based enterprise application suggests it might handle sensitive business logic and data.

Affects O2OA application code execution.
Exposed network endpoint allows unauthorized code execution.
Could lead to system compromise or data breaches.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in O2OA affects organizations using this platform, likely managed by application owners or platform teams responsible for its deployment and operation. The immediate priority is to locate all instances of O2OA, assess their exposure and business criticality, and identify the specific teams accountable for remediation. Once ownership is confirmed, a risk-based remediation plan can be developed, considering factors like planned maintenance windows or vendor coordination.

Application or platform teams own resolution.
Verify external reachability and business impact.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is O2OA?

O2OA is a web-based enterprise application platform designed to manage business processes and provide portal services. Organizations use it to centralize internal operations, often deploying it as a server-side application that facilitates remote work and manages complex organizational data workflows.

What does this RCE vulnerability mean?

This vulnerability is a Remote Code Execution (RCE) flaw. It allows an unauthorized person to run arbitrary commands on the underlying server that hosts O2OA. Essentially, it bypasses security controls to give an attacker the ability to execute instructions as if they were a legitimate system administrator.

How is the CVE-2022-22916 vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the /x_program_center/jaxrs/invoke endpoint. The vulnerability does not require the attacker to have pre-existing login credentials, nor does it require any action or interaction from legitimate users of the system to succeed.

Is my organization at risk from this O2OA issue?

Your risk depends on whether your O2OA instance is reachable from the internet. According to Halo Surface Signal, this platform is frequently deployed as a public-facing web application to support business operations. If your O2OA endpoint is accessible over the network, it is a potential target for remote exploitation.

What are the first steps to address this threat?

Begin by identifying all O2OA instances within your infrastructure and determining if they are reachable from the network. Once located, confirm the current version in use. Coordinate with your platform or application teams to prioritize these systems for remediation, ensuring they are protected according to your organization's risk management processes.

References

github.com/wendell1224/O2OA-POC/blob/main/POC.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.