Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp
70Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 9.3epss 0.7%
from disclosure to weapon
Published on NVDAug 7
VulnCheckOct 14
exploitation probability
0.7%top 51% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary secId and plandetailid field values. Successful exploitation results in remote code execution under the privileges of the application server process. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14 (UTC).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Weaver Network Co., Ltd. · E-cology 9.0public PoCs found — 2
cve_referencech0x01e.github.io/post/ecology9-wen-jian-shang-chuan-fen-xi/unverifiedcve_referencegithub.com/gmh5225/CVE-2022-HW-POC/blob/main/%E6%B3%9B%E5%BE%AEOA%20uploaderOperate.jsp%20%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://ch0x01e.github.io/post/ecology9-wen-jian-shang-chuan-fen-xi/https://cn-sec.com/archives/1208148.htmlhttps://github.com/gmh5225/CVE-2022-HW-POC/blob/main/%E6%B3%9B%E5%BE%AEOA%20uploaderOperate.jsp%20%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.mdhttps://www.vulncheck.com/advisories/weaver-e-cology-file-upload-rce-via-uploaderoperate-jsphttps://www.weaver.com.cn/cs/ecology_full_log_en.htmlhttps://www.weaver.com.cn/cs/securityDownload.html#