CVE-2020-37278: Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such as /etc/passwd or configuration and credential files, and the same endpoint's support for http(s) URLs also enables server-side request forgery against internal network resources. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker that can reach the saveYZJFile endpoint can exploit it; no authentication, user interaction, or prior privileges are required.
What can an attacker access or target through the vulnerable parameter?
An attacker can supply a file: URL in the downloadUrl parameter to read arbitrary files from the host, including files such as /etc/passwd and configuration or credential files. The endpoint also accepts http(s) URLs, which can be used to make server-side requests to internal network resources.
How can I determine whether exploitation may already have occurred?
Review requests to the saveYZJFile endpoint for downloadUrl values using file: URLs or URLs targeting internal resources. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.