CVE-2022-50992: Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods. Attackers can exploit these methods without authentication to retrieve sensitive files including system configuration files and database credentials from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-12-14 (UTC).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weaver (Fanwei) E-cology 9.5to a version that resolves this vulnerability.Fixed in 10.52 - Configuration
Disable the XML-RPC endpoint or restrict it so that unauthenticated remote attackers cannot access XmlRpcServlet methods (WorkflowService.getAttachment and WorkflowService.LoadTemplateProp).
Weaver (Fanwei) E-cology XML-RPC endpoint (XmlRpcServlet / XmlRpcServlet interface) XML-RPC exposure / availability = Disable or restrict unauthenticated access - Compensating control
Restrict network access to the server hosting the Weaver E-cology XML-RPC endpoint (XmlRpcServlet) to trusted IPs only, to reduce exposure to unauthenticated arbitrary file read attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50992?
CVE-2022-50992 is classified as a high severity vulnerability due to its ability to allow unauthenticated remote attackers to read arbitrary files.
How do I fix CVE-2022-50992?
To fix CVE-2022-50992, upgrade Weaver E-cology to version 10.52 or later to mitigate the arbitrary file read vulnerability.
What versions of Weaver E-cology are affected by CVE-2022-50992?
Weaver E-cology versions prior to 10.52 are affected by CVE-2022-50992.
Can CVE-2022-50992 be exploited remotely?
Yes, CVE-2022-50992 can be exploited remotely as it does not require authentication.
What type of vulnerability is CVE-2022-50992?
CVE-2022-50992 is an arbitrary file read vulnerability found in the XmlRpcServlet interface.