CVE-2022-34924

Landray Office Automation exposes an endpoint, /sys/ui/extend/varkind/custom.jsp, that lets an unauthenticated caller read arbitrary files off the server. No credentials, no user interaction, just a request that walks the filesystem and hands back whatever the web process can read, which typically includes configuration, credentials, and application source. It is confidentiality-only, but in an OA platform the files it can reach are exactly the ones that unlock the next step.

Chinese enterprise OA suites are a favored target precisely because they concentrate sensitive internal data and are frequently internet-exposed for remote staff. Unauthenticated file read on a named JSP path is trivially turned into a reliable one-liner, so it tends to circulate in scanning kits and get folded into broader intrusion playbooks rather than used for showy one-off attacks. The loot from reading config files often becomes the credential that enables authenticated code execution later.

Because the vulnerable request targets one specific path, this is a strong candidate for detection and virtual patching. We can write a rule that blocks or alerts on requests to that custom.jsp endpoint at the proxy while the underlying patch is scheduled, and hunt historical logs for prior hits since successful exploitation is quiet and leaves the file-read requests as its main trace.