CVE-2022-50992

Vulnerability

Description

The Weaver (Fanwei) E-cology 9.5 collaboration platform, versions prior to 10.52 (published 2022-07-31), contains an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint [1][3]. The root cause is a path traversal weakness (CWE-22) in the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods, which accept user-supplied file paths without proper validation [3].

Exploitation

An unauthenticated remote attacker can exploit this flaw by sending specially crafted requests to the XML-RPC endpoint, supplying arbitrary file paths to the vulnerable methods [1][3]. No authentication or special privileges are required, making the attack surface particularly broad. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-12-14 (UTC), indicating active scanning or misuse [1].

Impact

Successful exploitation allows an attacker to read arbitrary files from the server filesystem [1][3]. This includes sensitive data such as system configuration files, database credentials, and other confidential information that can lead to further compromise of the installation [1][3].

Mitigation

Weaver has addressed this vulnerability in E-cve in E-cology version 10.52 and later [1][3]. Users are strongly advised to upgrade to the latest release and apply full security patches regularly, as detailed in the vendor changelog and download center [2]. Administrators should also follow recommended security practices, including restricting unnecessary network ports and maintaining regular data backups [2].