External risk intelligence

Weaver E-cology File Upload Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2022-4995

The vulnerability affects a web-based enterprise collaboration platform. The vulnerable endpoint is a web application file upload handler, which is commonly exposed to the internet in normal deployments to support remote workforce access and external document sharing.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE describes a file upload vulnerability within the Weaver E-cology platform. Attackers could exploit this to upload malicious files, potentially leading to unauthorized control of the application server. The primary concern is to confirm if this specific platform is in use and assess any potential exposure.

Uploads allow attackers to gain control.
Affects collaboration platform, potential server compromise.
Confirm if our platform is impacted and assess risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload arbitrary files, such as webshells, to a vulnerable application by sending a specially crafted POST request. This allows them to execute commands on the application server with the privileges of the running process.

No authentication required.
Upload arbitrary files via a specific endpoint.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the application server. This could impact the confidentiality, integrity, and availability of the application and its data when accessed remotely.

Application server code execution.
Uploading malicious files to the server.
Compromise of the application and its data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects Weaver (Fanwei) E-cology, a widely deployed enterprise collaboration platform. The primary responsibility for addressing this issue likely falls to the application owners who manage the E-cology instances, supported by infrastructure or platform teams responsible for the underlying servers and network. The first practical step is to inventory all E-cology deployments, confirm their internet reachability and business criticality, and identify the accountable owner for each instance to prioritize remediation efforts.

Application owners should prioritize remediation.
Verify E-cology internet exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Weaver E-cology?

Weaver E-cology is an enterprise collaboration and office automation platform designed to help organizations manage internal workflows, document sharing, and business processes. It functions as a centralized hub for corporate operations, often acting as a bridge between internal teams and remote workers needing access to company files and collaborative tools.

What does CWE-434 mean for CVE-2022-4995?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of CVE-2022-4995, it means the application does not properly validate files sent to a specific upload component. An attacker can use this weakness to upload malicious scripts, such as webshells, which the server might then execute, granting the attacker unauthorized control over the application environment.

How is this file upload vulnerability triggered?

The vulnerability is triggered when an unauthenticated user sends a specifically crafted multipart/form-data POST request to a designated endpoint in the application. Note that legitimate file uploads for standard business tasks remain functional; the bug is specifically triggered by the submission of malicious file types alongside arbitrary identifier values that the system fails to block.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is likely relevant to your environment if you host Weaver E-cology on the internet. Because the affected component is a web-based file handler intended to support remote access, these instances are often exposed publicly by design, which increases the likelihood that an attacker can reach the vulnerable endpoint without needing prior access to your internal network.

What should I do if I use Weaver E-cology?

Your first step is to inventory all instances of Weaver E-cology within your environment to understand where the software is deployed and whether it is reachable from the internet. Once you have identified these systems, determine the current version and confirm ownership. Coordinate with your application and infrastructure teams to prioritize updating your installations to version 10.52 or later to resolve the underlying file upload weakness.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.