CVE-2022-4995 Weaver Network Co., Ltd. CVE debrief

Who should care

Defenders responsible for Weaver E-cology deployments should assess exposure and verify the integrity of uploaded files to prevent potential remote code execution. This includes reviewing compensating controls for exposed systems, checking relevant monitoring, detection, and logs for exposed assets, and tracking exceptions and retesting remediated assets.

Why it matters

CVE-2022-4995 is a critical file upload vulnerability in Weaver E-cology 9.0 versions prior to 10.52, allowing remote, unauthenticated attackers to upload arbitrary files, including JSP webshells, and potentially leading to remote code execution. Defenders should prioritize verifying exposure and assessing the integrity of uploaded files to prevent potential remote code execution and disruption of the application server process.

• Remote code execution under the privileges of the application server process
• Potential for unauthorized file uploads
• Need for verification of exposure and integrity of uploaded files
• Possible disruption of application server process

Technical summary

The CVE-2022-4995 vulnerability affects Weaver E-cology 9.0 versions prior to 10.52, allowing remote, unauthenticated attackers to upload arbitrary files, including JSP webshells, via a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp. Successful exploitation results in remote code execution under the privileges of the application server process. The vulnerability was first reported by the Shadowserver Foundation on 2023-10-14 (UTC). Defenders should prioritize verifying exposure of Weaver E-cology 9.0 versions prior to 10.52 and assessing the integrity of uploaded files.

Defensive priority

Defenders should prioritize verifying exposure of Weaver E-cology 9.0 versions prior to 10.52 and assessing the integrity of uploaded files.

Recommended defensive actions

• Verify exposure of Weaver E-cology 9.0 versions prior to 10.52
• Assess the integrity of uploaded files
• Restrict access to the /workrelate/plan/util/uploaderOperate.jsp endpoint
• Implement additional security controls to monitor and validate file uploads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates a file upload vulnerability in Weaver E-cology 9.0 versions prior to 10.52, allowing remote, unauthenticated attackers to upload arbitrary files, including JSP webshells. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14 (UTC).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.